Overview

overview

10

Static

static

10

1948b8cc0e...b8.exe

windows7_x64

10

1948b8cc0e...b8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1948b8cc0e1695e48898cc50ee35f4c833efd9b4c0f044f749eb9681317b12b8

  • Size

    108KB

  • Sample

    220212-dcdl9sgfer

  • MD5

    83c6de77e1428309ccbe44c4d12d52a0

  • SHA1

    ddecfd3a87e03efebf70fee9d66d17df9997a6aa

  • SHA256

    1948b8cc0e1695e48898cc50ee35f4c833efd9b4c0f044f749eb9681317b12b8

  • SHA512

    d73d07d674c5b7b46f3fef7c2e0f3b4d74d9a797609c7349a0da07121f6c83374bb5f30e91eaf565e949787bb51a63c8ae8291fad6594a7689b65454b6e1f948

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1948b8cc0e1695e48898cc50ee35f4c833efd9b4c0f044f749eb9681317b12b8

    • Size

      108KB

    • MD5

      83c6de77e1428309ccbe44c4d12d52a0

    • SHA1

      ddecfd3a87e03efebf70fee9d66d17df9997a6aa

    • SHA256

      1948b8cc0e1695e48898cc50ee35f4c833efd9b4c0f044f749eb9681317b12b8

    • SHA512

      d73d07d674c5b7b46f3fef7c2e0f3b4d74d9a797609c7349a0da07121f6c83374bb5f30e91eaf565e949787bb51a63c8ae8291fad6594a7689b65454b6e1f948

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks