Overview

overview

10

Static

static

18f985242f...4e.exe

windows7_x64

10

18f985242f...4e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18f985242f302d7c44251ee80e92cc4375127f7154d2774896cd20efdd63164e

  • Size

    60KB

  • Sample

    220212-dfghbsfbf7

  • MD5

    7608cfacc53522ecee9c65debd32b930

  • SHA1

    c6817bb99e233d826706b4491cc90567dc81f644

  • SHA256

    18f985242f302d7c44251ee80e92cc4375127f7154d2774896cd20efdd63164e

  • SHA512

    2473bf57d0599b6f2bdf53dac7bf1e9c2168d8bc227e5fa807966c23327de07bf78d577e42484013afeed2e823c7f0aafa8f261586bf972243d989667c171268

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18f985242f302d7c44251ee80e92cc4375127f7154d2774896cd20efdd63164e

    • Size

      60KB

    • MD5

      7608cfacc53522ecee9c65debd32b930

    • SHA1

      c6817bb99e233d826706b4491cc90567dc81f644

    • SHA256

      18f985242f302d7c44251ee80e92cc4375127f7154d2774896cd20efdd63164e

    • SHA512

      2473bf57d0599b6f2bdf53dac7bf1e9c2168d8bc227e5fa807966c23327de07bf78d577e42484013afeed2e823c7f0aafa8f261586bf972243d989667c171268

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks