Overview

overview

10

Static

static

188eb78f4c...96.exe

windows7_x64

10

188eb78f4c...96.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    188eb78f4ce4186de40c7260ffb07a673ce457357486c8fb7ab913a754c5a196

  • Size

    58KB

  • Sample

    220212-dl6z6sfcd6

  • MD5

    22171589b7cc9dbac6b1913100cbab40

  • SHA1

    4439f518bde68f7e3ac296302e650b4bee910591

  • SHA256

    188eb78f4ce4186de40c7260ffb07a673ce457357486c8fb7ab913a754c5a196

  • SHA512

    f20297fc73b2991a33eb04ecc40561ec547903c2b357dcbf29ff2ad4f1d40af38c815f66a129812f8b5511da8c46ab6e829177e0cd592f5fd37860d2e53eb9b9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      188eb78f4ce4186de40c7260ffb07a673ce457357486c8fb7ab913a754c5a196

    • Size

      58KB

    • MD5

      22171589b7cc9dbac6b1913100cbab40

    • SHA1

      4439f518bde68f7e3ac296302e650b4bee910591

    • SHA256

      188eb78f4ce4186de40c7260ffb07a673ce457357486c8fb7ab913a754c5a196

    • SHA512

      f20297fc73b2991a33eb04ecc40561ec547903c2b357dcbf29ff2ad4f1d40af38c815f66a129812f8b5511da8c46ab6e829177e0cd592f5fd37860d2e53eb9b9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks