Overview

overview

10

Static

static

16f27f7028...eb.exe

windows7_x64

10

16f27f7028...eb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16f27f7028a37fff30ea4791f1e507f3e382f13574c493730cd275e38a195feb

  • Size

    36KB

  • Sample

    220212-d9g1yshbck

  • MD5

    e0d468073ea71d761abd8fdd3d7b0122

  • SHA1

    33d5a3bb9c0936f6648c345b1efd4e9377640fd2

  • SHA256

    16f27f7028a37fff30ea4791f1e507f3e382f13574c493730cd275e38a195feb

  • SHA512

    8ce16a528160d8e3aaa36318f8caa3c83b357237bae138dc1918355b2da015b9f0e7e3af389408a72b4e4c77b1a8624597c53ab7d0ad85fe6ed53377ff10d127

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16f27f7028a37fff30ea4791f1e507f3e382f13574c493730cd275e38a195feb

    • Size

      36KB

    • MD5

      e0d468073ea71d761abd8fdd3d7b0122

    • SHA1

      33d5a3bb9c0936f6648c345b1efd4e9377640fd2

    • SHA256

      16f27f7028a37fff30ea4791f1e507f3e382f13574c493730cd275e38a195feb

    • SHA512

      8ce16a528160d8e3aaa36318f8caa3c83b357237bae138dc1918355b2da015b9f0e7e3af389408a72b4e4c77b1a8624597c53ab7d0ad85fe6ed53377ff10d127

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks