Overview

overview

10

Static

static

175082e34c...49.exe

windows7_x64

10

175082e34c...49.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    175082e34cd413bbe7f17705b14440ee80fbe791d63311f228cdbc98d44c1f49

  • Size

    36KB

  • Sample

    220212-d4j85afec6

  • MD5

    d726521aa21fcf505dc48654ba450692

  • SHA1

    ef3c9adc64f7e411d81dcdc93ed00bf0f01a9033

  • SHA256

    175082e34cd413bbe7f17705b14440ee80fbe791d63311f228cdbc98d44c1f49

  • SHA512

    a82dd4214eb5c37294c068af7c8da8fb84677d5fe8d9fb7d43149e6ab8f4f8b40773d2a8b11c61c8aad4ff14b86362782fddc96b4a54e41951f3cfa6e3770215

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      175082e34cd413bbe7f17705b14440ee80fbe791d63311f228cdbc98d44c1f49

    • Size

      36KB

    • MD5

      d726521aa21fcf505dc48654ba450692

    • SHA1

      ef3c9adc64f7e411d81dcdc93ed00bf0f01a9033

    • SHA256

      175082e34cd413bbe7f17705b14440ee80fbe791d63311f228cdbc98d44c1f49

    • SHA512

      a82dd4214eb5c37294c068af7c8da8fb84677d5fe8d9fb7d43149e6ab8f4f8b40773d2a8b11c61c8aad4ff14b86362782fddc96b4a54e41951f3cfa6e3770215

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks