Overview

overview

10

Static

static

10

191d583885...2b.exe

windows7_x64

10

191d583885...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    191d58388535debe9486a0611db2d9ce88ac59ee8dd363f3e36a0bd15008382b

  • Size

    99KB

  • Sample

    220212-dd85kafbe5

  • MD5

    e67a768d42802365f4e67b692939a50c

  • SHA1

    649e0ae34acea76ded16d47f404aff4c5e139420

  • SHA256

    191d58388535debe9486a0611db2d9ce88ac59ee8dd363f3e36a0bd15008382b

  • SHA512

    5f802a6f2941184fa12e31340b2bc76e85d9d2150fbd3be716ec275c952f15378b134d4ee5fca3f6475eaa2a66504414cac1aef8ce72d5db6e7aefc8eec24f88

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      191d58388535debe9486a0611db2d9ce88ac59ee8dd363f3e36a0bd15008382b

    • Size

      99KB

    • MD5

      e67a768d42802365f4e67b692939a50c

    • SHA1

      649e0ae34acea76ded16d47f404aff4c5e139420

    • SHA256

      191d58388535debe9486a0611db2d9ce88ac59ee8dd363f3e36a0bd15008382b

    • SHA512

      5f802a6f2941184fa12e31340b2bc76e85d9d2150fbd3be716ec275c952f15378b134d4ee5fca3f6475eaa2a66504414cac1aef8ce72d5db6e7aefc8eec24f88

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks