Overview

overview

10

Static

static

18e1d90ca1...10.exe

windows7_x64

10

18e1d90ca1...10.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18e1d90ca12f205dd4c4ec264ce3aa4e2f347573787181497995933c90c91110

  • Size

    36KB

  • Sample

    220212-dgy4rsggbr

  • MD5

    65561ffd1f189858693a92502e5e8c29

  • SHA1

    727fb5ea996aa46a5c1923dc254c4540d6b3d008

  • SHA256

    18e1d90ca12f205dd4c4ec264ce3aa4e2f347573787181497995933c90c91110

  • SHA512

    3ac8602fa87ad2ae01c91a3d2f4f153df7c33051a469f8690465885cf545c463535a9dd1e53741c844373981504571514c4b4087916ce1ee56d7e44c4385d392

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18e1d90ca12f205dd4c4ec264ce3aa4e2f347573787181497995933c90c91110

    • Size

      36KB

    • MD5

      65561ffd1f189858693a92502e5e8c29

    • SHA1

      727fb5ea996aa46a5c1923dc254c4540d6b3d008

    • SHA256

      18e1d90ca12f205dd4c4ec264ce3aa4e2f347573787181497995933c90c91110

    • SHA512

      3ac8602fa87ad2ae01c91a3d2f4f153df7c33051a469f8690465885cf545c463535a9dd1e53741c844373981504571514c4b4087916ce1ee56d7e44c4385d392

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks