Overview

overview

10

Static

static

10

193e12bd90...8a.exe

windows7_x64

10

193e12bd90...8a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    193e12bd90a42fd0a198b3178241a302823b5bc3ae2bc55c2736f2bae18d628a

  • Size

    101KB

  • Sample

    220212-dcp1asgffm

  • MD5

    57ce98c97c10d1d8c0cf7b1cef788cc2

  • SHA1

    e13e6ba76fbce3bd0f628ce92e99163c7ea19dfe

  • SHA256

    193e12bd90a42fd0a198b3178241a302823b5bc3ae2bc55c2736f2bae18d628a

  • SHA512

    aa8b751351ca940ce0c404ed82ede98f3a88a493603329e77055f2c71080a11064472668bc8c946ea88df82e077b35448d98ff787442954397b1fcfd3385888f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      193e12bd90a42fd0a198b3178241a302823b5bc3ae2bc55c2736f2bae18d628a

    • Size

      101KB

    • MD5

      57ce98c97c10d1d8c0cf7b1cef788cc2

    • SHA1

      e13e6ba76fbce3bd0f628ce92e99163c7ea19dfe

    • SHA256

      193e12bd90a42fd0a198b3178241a302823b5bc3ae2bc55c2736f2bae18d628a

    • SHA512

      aa8b751351ca940ce0c404ed82ede98f3a88a493603329e77055f2c71080a11064472668bc8c946ea88df82e077b35448d98ff787442954397b1fcfd3385888f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks