Overview

overview

10

Static

static

10

14e6eb2772...88.exe

windows7_x64

10

14e6eb2772...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14e6eb27725a5db12c0c096e901ed9568ba8e4c6849fa53401413738a1a34f88

  • Size

    79KB

  • Sample

    220212-e92wssgag9

  • MD5

    868465330d3df5760b689c3de2212417

  • SHA1

    06132c6941dd1326d9dc1a58d78141252cd64ab5

  • SHA256

    14e6eb27725a5db12c0c096e901ed9568ba8e4c6849fa53401413738a1a34f88

  • SHA512

    f87b00eb6d8de0bfecef40fe43a05b7f8a27409b2098dc796f8af07a420c7426d5c924098a2d5b5572b54596b3724531cca60c4313b2a0c17046a93ec0ea07d0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14e6eb27725a5db12c0c096e901ed9568ba8e4c6849fa53401413738a1a34f88

    • Size

      79KB

    • MD5

      868465330d3df5760b689c3de2212417

    • SHA1

      06132c6941dd1326d9dc1a58d78141252cd64ab5

    • SHA256

      14e6eb27725a5db12c0c096e901ed9568ba8e4c6849fa53401413738a1a34f88

    • SHA512

      f87b00eb6d8de0bfecef40fe43a05b7f8a27409b2098dc796f8af07a420c7426d5c924098a2d5b5572b54596b3724531cca60c4313b2a0c17046a93ec0ea07d0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks