Overview

overview

10

Static

static

18f69cafa8...47.exe

windows7_x64

10

18f69cafa8...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18f69cafa80da7f5f9dc6da53abc2afc42135397944cd520f0488fb7d68d4c47

  • Size

    35KB

  • Sample

    220212-dfnlmsfbf8

  • MD5

    76dc0c82b7195f4dcd20df2f69ec616c

  • SHA1

    d6d5e8d7c26f79d491c7dad5e28a5c8db5d68f2d

  • SHA256

    18f69cafa80da7f5f9dc6da53abc2afc42135397944cd520f0488fb7d68d4c47

  • SHA512

    613560202942b24dd6099e7dcbd9cad351606168a8d419a9f9e68e881661b5779ac06287c9e9e9e6c1f8729d9d3110ee6b0f9d69d134e180ebd3b3d02563541c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18f69cafa80da7f5f9dc6da53abc2afc42135397944cd520f0488fb7d68d4c47

    • Size

      35KB

    • MD5

      76dc0c82b7195f4dcd20df2f69ec616c

    • SHA1

      d6d5e8d7c26f79d491c7dad5e28a5c8db5d68f2d

    • SHA256

      18f69cafa80da7f5f9dc6da53abc2afc42135397944cd520f0488fb7d68d4c47

    • SHA512

      613560202942b24dd6099e7dcbd9cad351606168a8d419a9f9e68e881661b5779ac06287c9e9e9e6c1f8729d9d3110ee6b0f9d69d134e180ebd3b3d02563541c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks