Overview

overview

10

Static

static

17c388e80d...d1.exe

windows7_x64

10

17c388e80d...d1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17c388e80db296a8fab5b095d41c19aef91f663e6efa1d0b2f9f179af5396dd1

  • Size

    60KB

  • Sample

    220212-dxf8wsghhk

  • MD5

    f016221d044f377eaedf8043a78bc61a

  • SHA1

    517d4b89b4d9e5bbfb7e82483c861504f4432f1b

  • SHA256

    17c388e80db296a8fab5b095d41c19aef91f663e6efa1d0b2f9f179af5396dd1

  • SHA512

    975d5fd6845f10d3e06c3503036f2a2f92a70f8403d7967b80e9a0a1349f7a2fcb395d568da018ad12d9099e38ba200b661c13eeac5f9d55243d66907cd708cf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17c388e80db296a8fab5b095d41c19aef91f663e6efa1d0b2f9f179af5396dd1

    • Size

      60KB

    • MD5

      f016221d044f377eaedf8043a78bc61a

    • SHA1

      517d4b89b4d9e5bbfb7e82483c861504f4432f1b

    • SHA256

      17c388e80db296a8fab5b095d41c19aef91f663e6efa1d0b2f9f179af5396dd1

    • SHA512

      975d5fd6845f10d3e06c3503036f2a2f92a70f8403d7967b80e9a0a1349f7a2fcb395d568da018ad12d9099e38ba200b661c13eeac5f9d55243d66907cd708cf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks