Overview

overview

10

Static

static

1708c742b9...be.exe

windows7_x64

10

1708c742b9...be.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1708c742b99559e031afe0a2fdfb99424be5d0d4f3b23fce342b074e411284be

  • Size

    36KB

  • Sample

    220212-d8akgshbbj

  • MD5

    0400e0a6336cb890bd6758ff92a4cbfe

  • SHA1

    d977c372d6d39b8c8cd3845bb4c6b40065122c65

  • SHA256

    1708c742b99559e031afe0a2fdfb99424be5d0d4f3b23fce342b074e411284be

  • SHA512

    f72b1d28d624f49de27fd4fbd51e9766eecc0ce32e88fa8df34ab9956f7c9c242e2dd94ebff747545d891be9ab2bc48f3f1163f83ba2b49783b1f41aafe5cbf3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1708c742b99559e031afe0a2fdfb99424be5d0d4f3b23fce342b074e411284be

    • Size

      36KB

    • MD5

      0400e0a6336cb890bd6758ff92a4cbfe

    • SHA1

      d977c372d6d39b8c8cd3845bb4c6b40065122c65

    • SHA256

      1708c742b99559e031afe0a2fdfb99424be5d0d4f3b23fce342b074e411284be

    • SHA512

      f72b1d28d624f49de27fd4fbd51e9766eecc0ce32e88fa8df34ab9956f7c9c242e2dd94ebff747545d891be9ab2bc48f3f1163f83ba2b49783b1f41aafe5cbf3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks