Overview

overview

10

Static

static

10

17cbbd2309...ef.exe

windows7_x64

10

17cbbd2309...ef.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17cbbd2309db9bd675f65a6b310fca254380ca8871e3ac89397f3949a366fcef

  • Size

    92KB

  • Sample

    220212-dwnatafdd7

  • MD5

    971c47a28d02eea1633e3f78c9fe16fe

  • SHA1

    9f69e39d03cfccb9ffb295a271317346aaf11185

  • SHA256

    17cbbd2309db9bd675f65a6b310fca254380ca8871e3ac89397f3949a366fcef

  • SHA512

    4321ba49a0758764214bca6192ea2bfeb243bcea9b6194743203f5c928b2fcc07334c269d6ecd873fdb8343bf25e0cfc303e549b3ac99327c8cec795883703a3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17cbbd2309db9bd675f65a6b310fca254380ca8871e3ac89397f3949a366fcef

    • Size

      92KB

    • MD5

      971c47a28d02eea1633e3f78c9fe16fe

    • SHA1

      9f69e39d03cfccb9ffb295a271317346aaf11185

    • SHA256

      17cbbd2309db9bd675f65a6b310fca254380ca8871e3ac89397f3949a366fcef

    • SHA512

      4321ba49a0758764214bca6192ea2bfeb243bcea9b6194743203f5c928b2fcc07334c269d6ecd873fdb8343bf25e0cfc303e549b3ac99327c8cec795883703a3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks