Overview

overview

10

Static

static

10

172b4364d2...74.exe

windows7_x64

10

172b4364d2...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74

  • Size

    101KB

  • Sample

    220212-d6qtpafee7

  • MD5

    491209bf4babcd8217a1f3f63b62f413

  • SHA1

    58e2ca4d17101170fc816f79b40f8b8795e37996

  • SHA256

    172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74

  • SHA512

    14a6e377256f9c1ed95c4a45a07a28d4c3404dfae2217822d04c1a046c6984759ef452f1e0e331c25f237e4dd18fd0e63aa7af5253b5511c7c37c1a0a0b34f22

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74

    • Size

      101KB

    • MD5

      491209bf4babcd8217a1f3f63b62f413

    • SHA1

      58e2ca4d17101170fc816f79b40f8b8795e37996

    • SHA256

      172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74

    • SHA512

      14a6e377256f9c1ed95c4a45a07a28d4c3404dfae2217822d04c1a046c6984759ef452f1e0e331c25f237e4dd18fd0e63aa7af5253b5511c7c37c1a0a0b34f22

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks