Overview

overview

10

Static

static

1967015baa...61.exe

windows7_x64

10

1967015baa...61.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1967015baabed90cf1ed07c4f580304c386ff15147dd6000d4123345aece2d61

  • Size

    60KB

  • Sample

    220212-dbatzsfbb6

  • MD5

    93dd2642a61418943d5d57d8f80d4e93

  • SHA1

    eae8ae1c3e07422150f64b15faf7b10014111f73

  • SHA256

    1967015baabed90cf1ed07c4f580304c386ff15147dd6000d4123345aece2d61

  • SHA512

    951950992839750b78d1b986d2c7aedc4dbd95250a86dd1568c91a5cafa55a1a840b9fccc0ef5aef1292ffc64506efa9bac1ee4e03c3cf5788ccfaaa94d61ffa

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1967015baabed90cf1ed07c4f580304c386ff15147dd6000d4123345aece2d61

    • Size

      60KB

    • MD5

      93dd2642a61418943d5d57d8f80d4e93

    • SHA1

      eae8ae1c3e07422150f64b15faf7b10014111f73

    • SHA256

      1967015baabed90cf1ed07c4f580304c386ff15147dd6000d4123345aece2d61

    • SHA512

      951950992839750b78d1b986d2c7aedc4dbd95250a86dd1568c91a5cafa55a1a840b9fccc0ef5aef1292ffc64506efa9bac1ee4e03c3cf5788ccfaaa94d61ffa

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks