Overview

overview

10

Static

static

186125dfac...ac.exe

windows7_x64

10

186125dfac...ac.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    186125dfacf1b4a33019f045974e2338c43342d99ffe7746976f902440c840ac

  • Size

    58KB

  • Sample

    220212-dpslysfcg4

  • MD5

    3d7077d3656a2f35380a4a3443591058

  • SHA1

    223f5c4aed860eb0a0db8ed775e71b153bafbb6e

  • SHA256

    186125dfacf1b4a33019f045974e2338c43342d99ffe7746976f902440c840ac

  • SHA512

    08d9f6b5dc81137abc2943ad6a01be3c622bca95911c9841e9df58b638b5bfb7ef78506300c444eafa8ebb8ab19dfcb9cc2c5a466740c5c944cdfe99a78e4f54

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      186125dfacf1b4a33019f045974e2338c43342d99ffe7746976f902440c840ac

    • Size

      58KB

    • MD5

      3d7077d3656a2f35380a4a3443591058

    • SHA1

      223f5c4aed860eb0a0db8ed775e71b153bafbb6e

    • SHA256

      186125dfacf1b4a33019f045974e2338c43342d99ffe7746976f902440c840ac

    • SHA512

      08d9f6b5dc81137abc2943ad6a01be3c622bca95911c9841e9df58b638b5bfb7ef78506300c444eafa8ebb8ab19dfcb9cc2c5a466740c5c944cdfe99a78e4f54

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks