Overview

overview

10

Static

static

172d98f987...8c.exe

windows7_x64

10

172d98f987...8c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    172d98f98740f9cf2dfdd6392f941402cffa240a6ab0d7594594e818deea8a8c

  • Size

    36KB

  • Sample

    220212-d6ljzafee6

  • MD5

    98b7e6a2cd93decea71d84f4ba29194e

  • SHA1

    f1b03589d35cf0d6aaae07474761246d3929647c

  • SHA256

    172d98f98740f9cf2dfdd6392f941402cffa240a6ab0d7594594e818deea8a8c

  • SHA512

    ff23d0728812ec517a0c2be22204b6d668719bf04a29329bc2429826e1a20e7fe9e55067ab84b8e8322a8feb0def25f896835dbbf981c41975db0dc03ae2b5e6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      172d98f98740f9cf2dfdd6392f941402cffa240a6ab0d7594594e818deea8a8c

    • Size

      36KB

    • MD5

      98b7e6a2cd93decea71d84f4ba29194e

    • SHA1

      f1b03589d35cf0d6aaae07474761246d3929647c

    • SHA256

      172d98f98740f9cf2dfdd6392f941402cffa240a6ab0d7594594e818deea8a8c

    • SHA512

      ff23d0728812ec517a0c2be22204b6d668719bf04a29329bc2429826e1a20e7fe9e55067ab84b8e8322a8feb0def25f896835dbbf981c41975db0dc03ae2b5e6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks