Overview

overview

10

Static

static

10

182d48ccd7...f0.exe

windows7_x64

10

182d48ccd7...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    182d48ccd74ec557cbf580a7ad4ace3badfadc5fb2fabe435e6005ca83c59cf0

  • Size

    92KB

  • Sample

    220212-dslmtafda8

  • MD5

    01c7e82dfc5ccac6294c29f17aadec01

  • SHA1

    c1036ed8325342fd49fb3238b3182f05c515fd27

  • SHA256

    182d48ccd74ec557cbf580a7ad4ace3badfadc5fb2fabe435e6005ca83c59cf0

  • SHA512

    80620af0b3518e03c0aa878814d9b35dad1cc58ab498b1b2da3edca181c5507a658d2555d8fc110d8f296991110d1260650b8e8588b0e47e1b9fe3d54daaa388

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      182d48ccd74ec557cbf580a7ad4ace3badfadc5fb2fabe435e6005ca83c59cf0

    • Size

      92KB

    • MD5

      01c7e82dfc5ccac6294c29f17aadec01

    • SHA1

      c1036ed8325342fd49fb3238b3182f05c515fd27

    • SHA256

      182d48ccd74ec557cbf580a7ad4ace3badfadc5fb2fabe435e6005ca83c59cf0

    • SHA512

      80620af0b3518e03c0aa878814d9b35dad1cc58ab498b1b2da3edca181c5507a658d2555d8fc110d8f296991110d1260650b8e8588b0e47e1b9fe3d54daaa388

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks