Overview

overview

10

Static

static

17b53e453a...43.exe

windows7_x64

10

17b53e453a...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17b53e453a8a8860d8df10bc893ce75e1e1bb7e644b4dbc007148c9fc1730743

  • Size

    36KB

  • Sample

    220212-dykygahaal

  • MD5

    dee166336b7c538a166d6ea633cf02a1

  • SHA1

    a2ac485c77626ab73152dc4435485c62a0fbc946

  • SHA256

    17b53e453a8a8860d8df10bc893ce75e1e1bb7e644b4dbc007148c9fc1730743

  • SHA512

    a27b6516e28ee8227bdae2aa74584b8198cbb4b7afeedd2a19913720187fa0429751b245161951800c0f873f229682a50c8d45710331e5659c5cb0666c16dba0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17b53e453a8a8860d8df10bc893ce75e1e1bb7e644b4dbc007148c9fc1730743

    • Size

      36KB

    • MD5

      dee166336b7c538a166d6ea633cf02a1

    • SHA1

      a2ac485c77626ab73152dc4435485c62a0fbc946

    • SHA256

      17b53e453a8a8860d8df10bc893ce75e1e1bb7e644b4dbc007148c9fc1730743

    • SHA512

      a27b6516e28ee8227bdae2aa74584b8198cbb4b7afeedd2a19913720187fa0429751b245161951800c0f873f229682a50c8d45710331e5659c5cb0666c16dba0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks