Overview

overview

10

Static

static

10

188bea33b9...64.exe

windows7_x64

10

188bea33b9...64.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    188bea33b9aa52315eca9c5dcc3e66c835378528ab6ff23defeeae90d52cc564

  • Size

    216KB

  • Sample

    220212-dl85jafcd7

  • MD5

    4cfa10f30c3d09c1d441c35ad3b055ce

  • SHA1

    d6cb76b9986e9b5669ddf0f00743c5ff8e62da54

  • SHA256

    188bea33b9aa52315eca9c5dcc3e66c835378528ab6ff23defeeae90d52cc564

  • SHA512

    876c4e7cb813450cf5ec17aeca9cd609627ccb82f8c39239c2d5ef465722ec3af91fd1b36566ea6430310d125f4800896cfa7c4d3970b8b39a8890f9021ff21b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      188bea33b9aa52315eca9c5dcc3e66c835378528ab6ff23defeeae90d52cc564

    • Size

      216KB

    • MD5

      4cfa10f30c3d09c1d441c35ad3b055ce

    • SHA1

      d6cb76b9986e9b5669ddf0f00743c5ff8e62da54

    • SHA256

      188bea33b9aa52315eca9c5dcc3e66c835378528ab6ff23defeeae90d52cc564

    • SHA512

      876c4e7cb813450cf5ec17aeca9cd609627ccb82f8c39239c2d5ef465722ec3af91fd1b36566ea6430310d125f4800896cfa7c4d3970b8b39a8890f9021ff21b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks