Overview

overview

10

Static

static

18352dddd8...14.exe

windows7_x64

10

18352dddd8...14.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18352dddd8518a271c6d507af184686d20fc61c323905225d4a213cbf3cb1914

  • Size

    60KB

  • Sample

    220212-dscd5sfda5

  • MD5

    0b3cc975a4f24e4f0247bdaa0e9eb619

  • SHA1

    f7706c6cfa16e4c6ea5f3df878594478a9749484

  • SHA256

    18352dddd8518a271c6d507af184686d20fc61c323905225d4a213cbf3cb1914

  • SHA512

    7a418822d8e471afdb9c544a54701f5830ac4f0f69645f8b936a4c4c21699b4375d286a8d7017930afd1002110ca790746bea147e5032224094a16371fd9a328

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      18352dddd8518a271c6d507af184686d20fc61c323905225d4a213cbf3cb1914

    • Size

      60KB

    • MD5

      0b3cc975a4f24e4f0247bdaa0e9eb619

    • SHA1

      f7706c6cfa16e4c6ea5f3df878594478a9749484

    • SHA256

      18352dddd8518a271c6d507af184686d20fc61c323905225d4a213cbf3cb1914

    • SHA512

      7a418822d8e471afdb9c544a54701f5830ac4f0f69645f8b936a4c4c21699b4375d286a8d7017930afd1002110ca790746bea147e5032224094a16371fd9a328

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks