Overview

overview

10

Static

static

18930e73b6...ae.exe

windows7_x64

10

18930e73b6...ae.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18930e73b60e643fca11e6cd1eda83518b007ab1fbcf499789f59d9a62fa57ae

  • Size

    60KB

  • Sample

    220212-dlx29sfcd2

  • MD5

    c618ebe5d7700c3c9fdd0e253764d681

  • SHA1

    1deaf1cca921a9bd111338f36e0dbb9dfd8c6d72

  • SHA256

    18930e73b60e643fca11e6cd1eda83518b007ab1fbcf499789f59d9a62fa57ae

  • SHA512

    c363e9b3c789d233b2304d36ecccc04be2d07c58e36ecec75826767c07bf607edc635cc78e8c2476db9d8dc14c867e39b2950a7d3eb4d9567121689292cb79cf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18930e73b60e643fca11e6cd1eda83518b007ab1fbcf499789f59d9a62fa57ae

    • Size

      60KB

    • MD5

      c618ebe5d7700c3c9fdd0e253764d681

    • SHA1

      1deaf1cca921a9bd111338f36e0dbb9dfd8c6d72

    • SHA256

      18930e73b60e643fca11e6cd1eda83518b007ab1fbcf499789f59d9a62fa57ae

    • SHA512

      c363e9b3c789d233b2304d36ecccc04be2d07c58e36ecec75826767c07bf607edc635cc78e8c2476db9d8dc14c867e39b2950a7d3eb4d9567121689292cb79cf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks