Overview

overview

10

Static

static

175a578658...22.exe

windows7_x64

10

175a578658...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    175a5786581922bb10273e2a1b3722b820639bcdc56e2e3a5c9cdc22df2e7f22

  • Size

    60KB

  • Sample

    220212-d4ba8ahafj

  • MD5

    8247e097ba2ff19ab7b5750f9273239d

  • SHA1

    511e1c27a893703661b54af83f7e4cc60d16e8f2

  • SHA256

    175a5786581922bb10273e2a1b3722b820639bcdc56e2e3a5c9cdc22df2e7f22

  • SHA512

    0155c6842c44a15936615cc03e923ceb5102271f88308a662f1f53f3ce4958d656401a9f8b4f151614f717d050d3da45ddcfce858538f4cef727c750954b7b14

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      175a5786581922bb10273e2a1b3722b820639bcdc56e2e3a5c9cdc22df2e7f22

    • Size

      60KB

    • MD5

      8247e097ba2ff19ab7b5750f9273239d

    • SHA1

      511e1c27a893703661b54af83f7e4cc60d16e8f2

    • SHA256

      175a5786581922bb10273e2a1b3722b820639bcdc56e2e3a5c9cdc22df2e7f22

    • SHA512

      0155c6842c44a15936615cc03e923ceb5102271f88308a662f1f53f3ce4958d656401a9f8b4f151614f717d050d3da45ddcfce858538f4cef727c750954b7b14

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks