Overview

overview

10

Static

static

172e2f8d90...08.exe

windows7_x64

10

172e2f8d90...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    172e2f8d904cc75d5509ba8552622b198a8724c0ae6581522defcf50eb9d9108

  • Size

    58KB

  • Sample

    220212-d6jqdafee5

  • MD5

    7922880ec1fe3b1ece17fc3871a6985a

  • SHA1

    c37c62c07362be538a71c621b054018ebe6a86ca

  • SHA256

    172e2f8d904cc75d5509ba8552622b198a8724c0ae6581522defcf50eb9d9108

  • SHA512

    103e6cfbd6f5f59a211b720c5bef7d54277ea33534aae17a89e80b9bf0ceb318e8745507693ff97b4ed93a752e3c53d827a9c0819f87931f5dd1f07ae08e4cdb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      172e2f8d904cc75d5509ba8552622b198a8724c0ae6581522defcf50eb9d9108

    • Size

      58KB

    • MD5

      7922880ec1fe3b1ece17fc3871a6985a

    • SHA1

      c37c62c07362be538a71c621b054018ebe6a86ca

    • SHA256

      172e2f8d904cc75d5509ba8552622b198a8724c0ae6581522defcf50eb9d9108

    • SHA512

      103e6cfbd6f5f59a211b720c5bef7d54277ea33534aae17a89e80b9bf0ceb318e8745507693ff97b4ed93a752e3c53d827a9c0819f87931f5dd1f07ae08e4cdb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks