Overview

overview

10

Static

static

18c6310f39...d6.exe

windows7_x64

10

18c6310f39...d6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18c6310f399c5835efcecaca77ac49749bfe7e1c3535bb3eb9cc3b0496b169d6

  • Size

    58KB

  • Sample

    220212-dh7gjafca5

  • MD5

    b6282f0a881e6c9eb3fdb0b9521536b1

  • SHA1

    857c90acdf687847a8c5c90798f38fac88cd28c7

  • SHA256

    18c6310f399c5835efcecaca77ac49749bfe7e1c3535bb3eb9cc3b0496b169d6

  • SHA512

    0405d417524b5938cccb71f2163c38685c45325baeff52ce6c0b50847d99a155d5f98d0a09d9e1f8f21d2e018636d9ae83e7d86d09cf84573bf03ca3459b641c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18c6310f399c5835efcecaca77ac49749bfe7e1c3535bb3eb9cc3b0496b169d6

    • Size

      58KB

    • MD5

      b6282f0a881e6c9eb3fdb0b9521536b1

    • SHA1

      857c90acdf687847a8c5c90798f38fac88cd28c7

    • SHA256

      18c6310f399c5835efcecaca77ac49749bfe7e1c3535bb3eb9cc3b0496b169d6

    • SHA512

      0405d417524b5938cccb71f2163c38685c45325baeff52ce6c0b50847d99a155d5f98d0a09d9e1f8f21d2e018636d9ae83e7d86d09cf84573bf03ca3459b641c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks