Overview

overview

10

Static

static

17b73a2dd7...6d.exe

windows7_x64

10

17b73a2dd7...6d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17b73a2dd7ff623f1ec1c537958423b75d57a5debde43ca61920df4e42c0ee6d

  • Size

    36KB

  • Sample

    220212-dx65baghhr

  • MD5

    4549dbda12eef5539ed4ab19888e0b46

  • SHA1

    7e9a2bf7ba4861416b4f498b8f08398832b1970f

  • SHA256

    17b73a2dd7ff623f1ec1c537958423b75d57a5debde43ca61920df4e42c0ee6d

  • SHA512

    c4fb5385c2d4395a0b586d15b874224262a3aef45b96a8a3cfc32a1b61800b490224b3917b1b23bd45e4f41a8b8bd4beb76c34479ad01feb2123ff300358ac12

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17b73a2dd7ff623f1ec1c537958423b75d57a5debde43ca61920df4e42c0ee6d

    • Size

      36KB

    • MD5

      4549dbda12eef5539ed4ab19888e0b46

    • SHA1

      7e9a2bf7ba4861416b4f498b8f08398832b1970f

    • SHA256

      17b73a2dd7ff623f1ec1c537958423b75d57a5debde43ca61920df4e42c0ee6d

    • SHA512

      c4fb5385c2d4395a0b586d15b874224262a3aef45b96a8a3cfc32a1b61800b490224b3917b1b23bd45e4f41a8b8bd4beb76c34479ad01feb2123ff300358ac12

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks