Overview

overview

10

Static

static

10

1840e93b10...13.exe

windows7_x64

10

1840e93b10...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1840e93b10cd7c03dfe88b5239481496e95990099153e13bc713daff47652913

  • Size

    99KB

  • Sample

    220212-drpm3sghcm

  • MD5

    cb3a20ef626d3bcded0346a99b4c7fa6

  • SHA1

    d5785674b321257813e8275a08ae6a83166a8c2f

  • SHA256

    1840e93b10cd7c03dfe88b5239481496e95990099153e13bc713daff47652913

  • SHA512

    86b27b325c25cb3c8316373b530fe30fb12001cf9f519fe1aefc9f750aa20251b072968a08995390ea48fdad18851437c2871f694408ecc87ca839801866b1cf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1840e93b10cd7c03dfe88b5239481496e95990099153e13bc713daff47652913

    • Size

      99KB

    • MD5

      cb3a20ef626d3bcded0346a99b4c7fa6

    • SHA1

      d5785674b321257813e8275a08ae6a83166a8c2f

    • SHA256

      1840e93b10cd7c03dfe88b5239481496e95990099153e13bc713daff47652913

    • SHA512

      86b27b325c25cb3c8316373b530fe30fb12001cf9f519fe1aefc9f750aa20251b072968a08995390ea48fdad18851437c2871f694408ecc87ca839801866b1cf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks