Overview

overview

10

Static

static

17a1230933...c3.exe

windows7_x64

10

17a1230933...c3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17a1230933ff232131ef5cde5fd6927fa0e131c551c9c4ca2d83db662ea820c3

  • Size

    35KB

  • Sample

    220212-dzfp5shabl

  • MD5

    e87ed45b3e38840741218f0b5ef766bd

  • SHA1

    7b987de372e32adeeeb645596c4c40b590a73354

  • SHA256

    17a1230933ff232131ef5cde5fd6927fa0e131c551c9c4ca2d83db662ea820c3

  • SHA512

    41fb7fc4292ead01e07d1ecd243c1470074009763e6b13baed7c46451cf6c2446a4ccc545a53323c291536a69151ad6d90b6df87c5b4302c9e515e191838242b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      17a1230933ff232131ef5cde5fd6927fa0e131c551c9c4ca2d83db662ea820c3

    • Size

      35KB

    • MD5

      e87ed45b3e38840741218f0b5ef766bd

    • SHA1

      7b987de372e32adeeeb645596c4c40b590a73354

    • SHA256

      17a1230933ff232131ef5cde5fd6927fa0e131c551c9c4ca2d83db662ea820c3

    • SHA512

      41fb7fc4292ead01e07d1ecd243c1470074009763e6b13baed7c46451cf6c2446a4ccc545a53323c291536a69151ad6d90b6df87c5b4302c9e515e191838242b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks