Overview

overview

10

Static

static

191f8eba88...e1.exe

windows7_x64

10

191f8eba88...e1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    191f8eba88e39c1d50380fa9e21209842e229731b78ba66e5aec29f8499e56e1

  • Size

    60KB

  • Sample

    220212-dd6z7sfbe4

  • MD5

    7d03dd3299c8529b1a7bf2570dc62b7a

  • SHA1

    0a330a4a5f0d9949990a7ffebe3ee3c00ed25511

  • SHA256

    191f8eba88e39c1d50380fa9e21209842e229731b78ba66e5aec29f8499e56e1

  • SHA512

    74150921c35e16c0ef16d4ca1ffb44d0bb95b01909dec04a8510f073df249a0f6bf5d5d0cd3b981ed49667b2d8532074bf3ea2542593de01da8e19cb2a424579

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      191f8eba88e39c1d50380fa9e21209842e229731b78ba66e5aec29f8499e56e1

    • Size

      60KB

    • MD5

      7d03dd3299c8529b1a7bf2570dc62b7a

    • SHA1

      0a330a4a5f0d9949990a7ffebe3ee3c00ed25511

    • SHA256

      191f8eba88e39c1d50380fa9e21209842e229731b78ba66e5aec29f8499e56e1

    • SHA512

      74150921c35e16c0ef16d4ca1ffb44d0bb95b01909dec04a8510f073df249a0f6bf5d5d0cd3b981ed49667b2d8532074bf3ea2542593de01da8e19cb2a424579

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks