Overview

overview

10

Static

static

10

189723671c...f3.exe

windows7_x64

10

189723671c...f3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    189723671cbb5c6674f93e8b2beb6ddbf0a781ba5a9c6a6d4c8ad573d75c06f3

  • Size

    216KB

  • Sample

    220212-dlqyysfcc9

  • MD5

    40c5fb51bcf576c757738b507666d0fa

  • SHA1

    503905c395c0d7f83802d3144d4ec1d0756e3795

  • SHA256

    189723671cbb5c6674f93e8b2beb6ddbf0a781ba5a9c6a6d4c8ad573d75c06f3

  • SHA512

    9613b527836e526c164047cbb2af24050201b5907f4af7947bb5eda78fcbd74cc6e0d7edc969281bd80b7bdd2cd15f3e307967d4f97c02c7c49e50c4d51a6423

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      189723671cbb5c6674f93e8b2beb6ddbf0a781ba5a9c6a6d4c8ad573d75c06f3

    • Size

      216KB

    • MD5

      40c5fb51bcf576c757738b507666d0fa

    • SHA1

      503905c395c0d7f83802d3144d4ec1d0756e3795

    • SHA256

      189723671cbb5c6674f93e8b2beb6ddbf0a781ba5a9c6a6d4c8ad573d75c06f3

    • SHA512

      9613b527836e526c164047cbb2af24050201b5907f4af7947bb5eda78fcbd74cc6e0d7edc969281bd80b7bdd2cd15f3e307967d4f97c02c7c49e50c4d51a6423

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks