Overview

overview

10

Static

static

10

185e705dbb...18.exe

windows7_x64

10

185e705dbb...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    185e705dbb8e46409587cd5192da2e6a6aa5db77be8c5714d1b75cf9ac9cd618

  • Size

    89KB

  • Sample

    220212-dp4zzsfcg7

  • MD5

    b871b7f7601a78a372241089a4370bb1

  • SHA1

    14565f15d001f5f892cbf300dbb2e08dffad03fd

  • SHA256

    185e705dbb8e46409587cd5192da2e6a6aa5db77be8c5714d1b75cf9ac9cd618

  • SHA512

    6dae0e80913360dc492b3d3b95e086d4cbaa63583bc1a1cb553ab649e9745356dd654e5b65b061651e87205b2526556c6dea2344f1c0d7afdd5610dad74888b3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      185e705dbb8e46409587cd5192da2e6a6aa5db77be8c5714d1b75cf9ac9cd618

    • Size

      89KB

    • MD5

      b871b7f7601a78a372241089a4370bb1

    • SHA1

      14565f15d001f5f892cbf300dbb2e08dffad03fd

    • SHA256

      185e705dbb8e46409587cd5192da2e6a6aa5db77be8c5714d1b75cf9ac9cd618

    • SHA512

      6dae0e80913360dc492b3d3b95e086d4cbaa63583bc1a1cb553ab649e9745356dd654e5b65b061651e87205b2526556c6dea2344f1c0d7afdd5610dad74888b3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks