Overview

overview

10

Static

static

195491404e...5b.exe

windows7_x64

10

195491404e...5b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b

  • Size

    36KB

  • Sample

    220212-db1emsfbc4

  • MD5

    9cde14dc0aebafb60af5a67654cb84a8

  • SHA1

    5316dfbcb178e438f869746ca8a2edd4a2491c5c

  • SHA256

    195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b

  • SHA512

    af88ed25d6dbea45725d7cedc422f0fc83e5ba7f2a2478b3d2408305d8858c8aa5b533817073a3e6354578c988424adbb0d9dd0e8356a24dc1f6269ab913e082

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b

    • Size

      36KB

    • MD5

      9cde14dc0aebafb60af5a67654cb84a8

    • SHA1

      5316dfbcb178e438f869746ca8a2edd4a2491c5c

    • SHA256

      195491404eb4efbfe301716bd004a65b5f5f900a759126b01e5ba789cf51fc5b

    • SHA512

      af88ed25d6dbea45725d7cedc422f0fc83e5ba7f2a2478b3d2408305d8858c8aa5b533817073a3e6354578c988424adbb0d9dd0e8356a24dc1f6269ab913e082

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks