Overview

overview

10

Static

static

10

1843439f1a...d1.exe

windows7_x64

10

1843439f1a...d1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1843439f1ae3a57606730c436e2c766ff8f2f0200033732ca30baca71ea721d1

  • Size

    99KB

  • Sample

    220212-drgmgafch6

  • MD5

    ce1dc859ad57039ca0c18da4f70db317

  • SHA1

    c54425a17728cabd496e63261f0e6ddfbc7985d7

  • SHA256

    1843439f1ae3a57606730c436e2c766ff8f2f0200033732ca30baca71ea721d1

  • SHA512

    6ced4bd925cca2d8d664a25b9deec2fb79e6953ca3c73c57df27cee93dded0c0ecca451baa594af842007b61228d48e2001d6a77103b6589080eabf9d0df9a8b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1843439f1ae3a57606730c436e2c766ff8f2f0200033732ca30baca71ea721d1

    • Size

      99KB

    • MD5

      ce1dc859ad57039ca0c18da4f70db317

    • SHA1

      c54425a17728cabd496e63261f0e6ddfbc7985d7

    • SHA256

      1843439f1ae3a57606730c436e2c766ff8f2f0200033732ca30baca71ea721d1

    • SHA512

      6ced4bd925cca2d8d664a25b9deec2fb79e6953ca3c73c57df27cee93dded0c0ecca451baa594af842007b61228d48e2001d6a77103b6589080eabf9d0df9a8b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks