Overview

overview

10

Static

static

18d891a480...27.exe

windows7_x64

10

18d891a480...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d891a4809157b333ebf15f548fb0444a5e9d3327311a55115c4e68e15d8f27

  • Size

    36KB

  • Sample

    220212-dhcl6afbh3

  • MD5

    8bdf3990a2c013622785448a0eb9be20

  • SHA1

    145a351613d21fdc80fdd9f1c44a80fba2257604

  • SHA256

    18d891a4809157b333ebf15f548fb0444a5e9d3327311a55115c4e68e15d8f27

  • SHA512

    004d2f777388c97fd1e094fa1ae45bdbb26c1147c8090ae8a67e7061fbb3fee5f882070624a9bb45d3bf646c2d7b5cc1eed7e946ac229b8b1a910109d0e57908

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18d891a4809157b333ebf15f548fb0444a5e9d3327311a55115c4e68e15d8f27

    • Size

      36KB

    • MD5

      8bdf3990a2c013622785448a0eb9be20

    • SHA1

      145a351613d21fdc80fdd9f1c44a80fba2257604

    • SHA256

      18d891a4809157b333ebf15f548fb0444a5e9d3327311a55115c4e68e15d8f27

    • SHA512

      004d2f777388c97fd1e094fa1ae45bdbb26c1147c8090ae8a67e7061fbb3fee5f882070624a9bb45d3bf646c2d7b5cc1eed7e946ac229b8b1a910109d0e57908

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks