Overview

overview

10

Static

static

10

1923e4bd7d...56.exe

windows7_x64

10

1923e4bd7d...56.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1923e4bd7d1a9ca350bda169aeec19f6a1ea765c197e6bdfcf2672486abce256

  • Size

    99KB

  • Sample

    220212-ddxrjagfgq

  • MD5

    65b23a7fb30e20ba860c2989f447a388

  • SHA1

    fc7348a0c16db11799c0ebf410d4b03c9ddf3204

  • SHA256

    1923e4bd7d1a9ca350bda169aeec19f6a1ea765c197e6bdfcf2672486abce256

  • SHA512

    6630b6ea88d93587092f99efdb9990ad101c01265f05c6a8bd92f9c7a7fc93f454cee862aa128b0fe28c42e0bb67db36e9fc32e5de0b7004c184d82a3e891b03

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1923e4bd7d1a9ca350bda169aeec19f6a1ea765c197e6bdfcf2672486abce256

    • Size

      99KB

    • MD5

      65b23a7fb30e20ba860c2989f447a388

    • SHA1

      fc7348a0c16db11799c0ebf410d4b03c9ddf3204

    • SHA256

      1923e4bd7d1a9ca350bda169aeec19f6a1ea765c197e6bdfcf2672486abce256

    • SHA512

      6630b6ea88d93587092f99efdb9990ad101c01265f05c6a8bd92f9c7a7fc93f454cee862aa128b0fe28c42e0bb67db36e9fc32e5de0b7004c184d82a3e891b03

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks