Overview

overview

10

Static

static

16ed4c37b8...d2.exe

windows7_x64

10

16ed4c37b8...d2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16ed4c37b883e137e1d39c6ebaa3140e53867ef2bc0e9bc900bfad48a4fcf7d2

  • Size

    36KB

  • Sample

    220212-d9t1hsfeh9

  • MD5

    83d8217b0453591545e1e492b9ba00b2

  • SHA1

    aa769230829e142b76a46f68a2a1a035b074a7f4

  • SHA256

    16ed4c37b883e137e1d39c6ebaa3140e53867ef2bc0e9bc900bfad48a4fcf7d2

  • SHA512

    72a59a78deb507daf40a1906f93d338d37894b1ee546f6678bce5b926a47c3ead36d17e70b78c337c3c6e0f5beb02124f1e45d3c015484ffefa3f75cf847d6cf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16ed4c37b883e137e1d39c6ebaa3140e53867ef2bc0e9bc900bfad48a4fcf7d2

    • Size

      36KB

    • MD5

      83d8217b0453591545e1e492b9ba00b2

    • SHA1

      aa769230829e142b76a46f68a2a1a035b074a7f4

    • SHA256

      16ed4c37b883e137e1d39c6ebaa3140e53867ef2bc0e9bc900bfad48a4fcf7d2

    • SHA512

      72a59a78deb507daf40a1906f93d338d37894b1ee546f6678bce5b926a47c3ead36d17e70b78c337c3c6e0f5beb02124f1e45d3c015484ffefa3f75cf847d6cf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks