Overview

overview

10

Static

static

18e723d799...2d.exe

windows7_x64

10

18e723d799...2d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d

  • Size

    58KB

  • Sample

    220212-dgpkbsggbn

  • MD5

    fd9dc5b8fa418f96c34d31639851ed29

  • SHA1

    1375a117559a9e6c8db10555f77c43f0501d8837

  • SHA256

    18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d

  • SHA512

    834331b80daaa3fea4a66eade9c020d754a1923cc8c8164422c44d7a77302a295b52dcd931ba19f76f9e73f92358e4c4f1f293e489bb8fd700f7f0db091142df

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d

    • Size

      58KB

    • MD5

      fd9dc5b8fa418f96c34d31639851ed29

    • SHA1

      1375a117559a9e6c8db10555f77c43f0501d8837

    • SHA256

      18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d

    • SHA512

      834331b80daaa3fea4a66eade9c020d754a1923cc8c8164422c44d7a77302a295b52dcd931ba19f76f9e73f92358e4c4f1f293e489bb8fd700f7f0db091142df

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks