Overview

overview

10

Static

static

1837183b15...cb.exe

windows7_x64

10

1837183b15...cb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1837183b15fcd4fdb30ac0217ab140c8f7fef744a475c7d07959791abed9c6cb

  • Size

    36KB

  • Sample

    220212-dsakjsghdj

  • MD5

    bc54e4ea35a3b43b2d026c7a24e42e70

  • SHA1

    268e12aaf47b767a5d4850b965f43349fd59c5b9

  • SHA256

    1837183b15fcd4fdb30ac0217ab140c8f7fef744a475c7d07959791abed9c6cb

  • SHA512

    6a6b7e3b91f8c11adb8c94d538f6454cdf7bc54f60dbd3eefe526069f3b01c37a56880819a9c21d80d2fdc3713d8b666a7dc3c473a7b0787b8618fa30c1424dd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1837183b15fcd4fdb30ac0217ab140c8f7fef744a475c7d07959791abed9c6cb

    • Size

      36KB

    • MD5

      bc54e4ea35a3b43b2d026c7a24e42e70

    • SHA1

      268e12aaf47b767a5d4850b965f43349fd59c5b9

    • SHA256

      1837183b15fcd4fdb30ac0217ab140c8f7fef744a475c7d07959791abed9c6cb

    • SHA512

      6a6b7e3b91f8c11adb8c94d538f6454cdf7bc54f60dbd3eefe526069f3b01c37a56880819a9c21d80d2fdc3713d8b666a7dc3c473a7b0787b8618fa30c1424dd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks