Overview

overview

10

Static

static

17ca715adf...97.exe

windows7_x64

10

17ca715adf...97.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17ca715adf1fc0fda769faf4c7f13f62580e8d7f1d6285c5ef884d3ff57d1c97

  • Size

    35KB

  • Sample

    220212-dwzzlsghgr

  • MD5

    a4402b185b8425c43dc3833e5796a038

  • SHA1

    b6967f506a5034c57dff5d02b75828b9ed5aa13e

  • SHA256

    17ca715adf1fc0fda769faf4c7f13f62580e8d7f1d6285c5ef884d3ff57d1c97

  • SHA512

    7b218bceb4b81b5ccd5def0f732f12b28c516cdbf23bb89971503fdc1d1c29f7933c623a7dac60ec05673c87eb7f2171bd530a1f3bfa1ba964ac53923cd201c9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17ca715adf1fc0fda769faf4c7f13f62580e8d7f1d6285c5ef884d3ff57d1c97

    • Size

      35KB

    • MD5

      a4402b185b8425c43dc3833e5796a038

    • SHA1

      b6967f506a5034c57dff5d02b75828b9ed5aa13e

    • SHA256

      17ca715adf1fc0fda769faf4c7f13f62580e8d7f1d6285c5ef884d3ff57d1c97

    • SHA512

      7b218bceb4b81b5ccd5def0f732f12b28c516cdbf23bb89971503fdc1d1c29f7933c623a7dac60ec05673c87eb7f2171bd530a1f3bfa1ba964ac53923cd201c9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks