Overview

overview

10

Static

static

10

18a3706093...46.exe

windows7_x64

10

18a3706093...46.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18a37060939d2494e98792fd27ef274a9796508b4eff66034541766634bf6246

  • Size

    150KB

  • Sample

    220212-dk91fafcc3

  • MD5

    c44f6485b81f5be95d0d3ad03873c16f

  • SHA1

    622040b375a38950a91162842a7dc1b1d3d0f41c

  • SHA256

    18a37060939d2494e98792fd27ef274a9796508b4eff66034541766634bf6246

  • SHA512

    2fe403b0f00a04a036eeda39aefc6f94ba13a5b3cf47f2813a3ddf2b3e5725c4e3ea68d8e69fecbb4f3c8cc8b7067a56c20e87d84929b784ce7ee57276387bee

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18a37060939d2494e98792fd27ef274a9796508b4eff66034541766634bf6246

    • Size

      150KB

    • MD5

      c44f6485b81f5be95d0d3ad03873c16f

    • SHA1

      622040b375a38950a91162842a7dc1b1d3d0f41c

    • SHA256

      18a37060939d2494e98792fd27ef274a9796508b4eff66034541766634bf6246

    • SHA512

      2fe403b0f00a04a036eeda39aefc6f94ba13a5b3cf47f2813a3ddf2b3e5725c4e3ea68d8e69fecbb4f3c8cc8b7067a56c20e87d84929b784ce7ee57276387bee

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks