Overview

overview

10

Static

static

17dbb1b565...34.exe

windows7_x64

10

17dbb1b565...34.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17dbb1b565504eaba879d10ab35b5478e35c4293158115ae0dca2339608d5a34

  • Size

    60KB

  • Sample

    220212-dv9sesghgl

  • MD5

    9d8c0111a81c0f9ec945597467d7167f

  • SHA1

    aad4d5baab10ebb2ac71e7857849456d22aa452a

  • SHA256

    17dbb1b565504eaba879d10ab35b5478e35c4293158115ae0dca2339608d5a34

  • SHA512

    662402ff021d1d36504a3c392d9aca76f4a0fc199c8df3b6d5e7d46637689211d241b70a67ade624961a9c8067df786e206c67aa40323d501f17baf3d172f2bd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17dbb1b565504eaba879d10ab35b5478e35c4293158115ae0dca2339608d5a34

    • Size

      60KB

    • MD5

      9d8c0111a81c0f9ec945597467d7167f

    • SHA1

      aad4d5baab10ebb2ac71e7857849456d22aa452a

    • SHA256

      17dbb1b565504eaba879d10ab35b5478e35c4293158115ae0dca2339608d5a34

    • SHA512

      662402ff021d1d36504a3c392d9aca76f4a0fc199c8df3b6d5e7d46637689211d241b70a67ade624961a9c8067df786e206c67aa40323d501f17baf3d172f2bd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks