Overview

overview

10

Static

static

10

1971c56b1f...ed.exe

windows7_x64

10

1971c56b1f...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1971c56b1ff468066e445e7f719876fc8a2cb166810639a0df1b137dd65875ed

  • Size

    100KB

  • Sample

    220212-daj19sfbb2

  • MD5

    285fda8557a7b785c9f6e7a020bd5087

  • SHA1

    d87ab460171ad178bf1de5694198ed13dd219045

  • SHA256

    1971c56b1ff468066e445e7f719876fc8a2cb166810639a0df1b137dd65875ed

  • SHA512

    9a6d8b3b4d733dc15390f09897f4ad14492a83706aa58b31e33819825630aebe768a9c158880a11180fca49441bdb814779babd7236d25e6242254a5f4a4f840

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1971c56b1ff468066e445e7f719876fc8a2cb166810639a0df1b137dd65875ed

    • Size

      100KB

    • MD5

      285fda8557a7b785c9f6e7a020bd5087

    • SHA1

      d87ab460171ad178bf1de5694198ed13dd219045

    • SHA256

      1971c56b1ff468066e445e7f719876fc8a2cb166810639a0df1b137dd65875ed

    • SHA512

      9a6d8b3b4d733dc15390f09897f4ad14492a83706aa58b31e33819825630aebe768a9c158880a11180fca49441bdb814779babd7236d25e6242254a5f4a4f840

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks