Overview

overview

10

Static

static

170a71482a...95.exe

windows7_x64

10

170a71482a...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    170a71482ad1d203f39e90de330128a43bc26f3646f7cffd07ffd0082e477595

  • Size

    35KB

  • Sample

    220212-d7y7fshbap

  • MD5

    adc1bb46dd5d2a05678d17f680da93c2

  • SHA1

    9e6f2fbf8e0c3395b683549a9bcab2646d8efb87

  • SHA256

    170a71482ad1d203f39e90de330128a43bc26f3646f7cffd07ffd0082e477595

  • SHA512

    a3b6301439a5588b86d18bddcc6331dd7df73c340005d732f6ec64eaded838be55ab093723d4f37a990a695bb82588c44694bdeb7bf2937a6f5265c575e94b1b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      170a71482ad1d203f39e90de330128a43bc26f3646f7cffd07ffd0082e477595

    • Size

      35KB

    • MD5

      adc1bb46dd5d2a05678d17f680da93c2

    • SHA1

      9e6f2fbf8e0c3395b683549a9bcab2646d8efb87

    • SHA256

      170a71482ad1d203f39e90de330128a43bc26f3646f7cffd07ffd0082e477595

    • SHA512

      a3b6301439a5588b86d18bddcc6331dd7df73c340005d732f6ec64eaded838be55ab093723d4f37a990a695bb82588c44694bdeb7bf2937a6f5265c575e94b1b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks