Overview

overview

10

Static

static

179ded5b97...13.exe

windows7_x64

10

179ded5b97...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713

  • Size

    35KB

  • Sample

    220212-dzkn4ahabm

  • MD5

    4889443e1899077b93dc8af4a117580e

  • SHA1

    63f2bdd9f5a7d0f51a12a11b171a41bfdae2599c

  • SHA256

    179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713

  • SHA512

    23e3ccacf6820f514021eeb2582ff2603d06adeee4a32a14780b985a5c229a7f0157b6a146499e579266d3180ae4d6d2b3caa4ba67230535722a29b203ee4d2a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713

    • Size

      35KB

    • MD5

      4889443e1899077b93dc8af4a117580e

    • SHA1

      63f2bdd9f5a7d0f51a12a11b171a41bfdae2599c

    • SHA256

      179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713

    • SHA512

      23e3ccacf6820f514021eeb2582ff2603d06adeee4a32a14780b985a5c229a7f0157b6a146499e579266d3180ae4d6d2b3caa4ba67230535722a29b203ee4d2a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks