Overview

overview

10

Static

static

1550fbbc21...fc.exe

windows7_x64

10

1550fbbc21...fc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1550fbbc213511400356ede5d25790dc2a4dd3972a3ef6411e6edf05febe51fc

  • Size

    60KB

  • Sample

    220212-e2gwnahedr

  • MD5

    6465d2c39ed8bb5535b033fb2341096b

  • SHA1

    a3420e090d46a990fc35087915939247f46c6ef4

  • SHA256

    1550fbbc213511400356ede5d25790dc2a4dd3972a3ef6411e6edf05febe51fc

  • SHA512

    219a94316afb7d5d56f2d9a53da196bb6dc90de7281f0939a87d93dd940757a9882fadf3aaefaf8c0807a09a0c79bdb1b1171c0bd84a4441f8b5e3773f9d70d2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1550fbbc213511400356ede5d25790dc2a4dd3972a3ef6411e6edf05febe51fc

    • Size

      60KB

    • MD5

      6465d2c39ed8bb5535b033fb2341096b

    • SHA1

      a3420e090d46a990fc35087915939247f46c6ef4

    • SHA256

      1550fbbc213511400356ede5d25790dc2a4dd3972a3ef6411e6edf05febe51fc

    • SHA512

      219a94316afb7d5d56f2d9a53da196bb6dc90de7281f0939a87d93dd940757a9882fadf3aaefaf8c0807a09a0c79bdb1b1171c0bd84a4441f8b5e3773f9d70d2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks