Overview

overview

10

Static

static

17b0bdd2b9...46.exe

windows7_x64

10

17b0bdd2b9...46.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17b0bdd2b988129d51c9f70796cd88ebf54d6530040490b0440a0f5c61b6a646

  • Size

    36KB

  • Sample

    220212-dyscjsfdf8

  • MD5

    4d0b4d2202776de197ba86e39a84b518

  • SHA1

    9d40329effacfa12d5c87b2f3c1116adb08d42f9

  • SHA256

    17b0bdd2b988129d51c9f70796cd88ebf54d6530040490b0440a0f5c61b6a646

  • SHA512

    44217ee231a1a98a747256dde4ebadeb7a53a41f8002dc1d6b71612a8cc740188edb44bdff1d470d9a10501d42abe69845d0c1ab34d0de0ed56e29f5b9296598

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17b0bdd2b988129d51c9f70796cd88ebf54d6530040490b0440a0f5c61b6a646

    • Size

      36KB

    • MD5

      4d0b4d2202776de197ba86e39a84b518

    • SHA1

      9d40329effacfa12d5c87b2f3c1116adb08d42f9

    • SHA256

      17b0bdd2b988129d51c9f70796cd88ebf54d6530040490b0440a0f5c61b6a646

    • SHA512

      44217ee231a1a98a747256dde4ebadeb7a53a41f8002dc1d6b71612a8cc740188edb44bdff1d470d9a10501d42abe69845d0c1ab34d0de0ed56e29f5b9296598

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks