Overview

overview

10

Static

static

10

1908fd444c...a3.exe

windows7_x64

10

1908fd444c...a3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1908fd444cb479571085d2056682bb1c62922e8b2b6eb59d25e1d66d81c504a3

  • Size

    99KB

  • Sample

    220212-de2f4sfbf2

  • MD5

    2918878aa2cb8e64030cd08cc90ad800

  • SHA1

    53b870c63d97e3395366e10f20fe00a3931ea2b7

  • SHA256

    1908fd444cb479571085d2056682bb1c62922e8b2b6eb59d25e1d66d81c504a3

  • SHA512

    3810d68cdc24412ef2c59732fa4b80838efe6afbe98691b55df4b05fde46e22d87022def73763c2af14ab08b9509c3848ae899bbbf6c12c9b276d964d2b0f78a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1908fd444cb479571085d2056682bb1c62922e8b2b6eb59d25e1d66d81c504a3

    • Size

      99KB

    • MD5

      2918878aa2cb8e64030cd08cc90ad800

    • SHA1

      53b870c63d97e3395366e10f20fe00a3931ea2b7

    • SHA256

      1908fd444cb479571085d2056682bb1c62922e8b2b6eb59d25e1d66d81c504a3

    • SHA512

      3810d68cdc24412ef2c59732fa4b80838efe6afbe98691b55df4b05fde46e22d87022def73763c2af14ab08b9509c3848ae899bbbf6c12c9b276d964d2b0f78a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks