Overview

overview

10

Static

static

182645e158...88.exe

windows7_x64

10

182645e158...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    182645e1585c9bc5148e547cec71092bce85ade104ef44ca6fb3602cc8f74588

  • Size

    36KB

  • Sample

    220212-dss2wsfdb2

  • MD5

    087127698eb489073af5222827193e73

  • SHA1

    5611892ba4677ceb8f122722439169c45c594e2a

  • SHA256

    182645e1585c9bc5148e547cec71092bce85ade104ef44ca6fb3602cc8f74588

  • SHA512

    83a471a2ed752390d8bce9baedd95c7c09befcb060cf5ff3e65f397d1a16a39467a72e0db6805b63c99bee9e6c32258d6671d06fd535d4b0554da20a63195cf2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      182645e1585c9bc5148e547cec71092bce85ade104ef44ca6fb3602cc8f74588

    • Size

      36KB

    • MD5

      087127698eb489073af5222827193e73

    • SHA1

      5611892ba4677ceb8f122722439169c45c594e2a

    • SHA256

      182645e1585c9bc5148e547cec71092bce85ade104ef44ca6fb3602cc8f74588

    • SHA512

      83a471a2ed752390d8bce9baedd95c7c09befcb060cf5ff3e65f397d1a16a39467a72e0db6805b63c99bee9e6c32258d6671d06fd535d4b0554da20a63195cf2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks