Overview

overview

10

Static

static

14e3962f68...08.exe

windows7_x64

10

14e3962f68...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14e3962f6852ea6b41d365bf369e03f0ef3db7306ae1e0c5243a3152a45f7e08

  • Size

    58KB

  • Sample

    220212-e966hsgah3

  • MD5

    2cd1887f35425986b88c6ba6390f44aa

  • SHA1

    009071587453697414d27161a0dbf4c83ccb585e

  • SHA256

    14e3962f6852ea6b41d365bf369e03f0ef3db7306ae1e0c5243a3152a45f7e08

  • SHA512

    ffd268bd7cc2e52a275973e411e6434cdf7320c0da41d229eddd2a47488fead8743a6e9d89e7d92d8a3e4eb25fd915c692f26ab49b76c2744047305326b419b7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14e3962f6852ea6b41d365bf369e03f0ef3db7306ae1e0c5243a3152a45f7e08

    • Size

      58KB

    • MD5

      2cd1887f35425986b88c6ba6390f44aa

    • SHA1

      009071587453697414d27161a0dbf4c83ccb585e

    • SHA256

      14e3962f6852ea6b41d365bf369e03f0ef3db7306ae1e0c5243a3152a45f7e08

    • SHA512

      ffd268bd7cc2e52a275973e411e6434cdf7320c0da41d229eddd2a47488fead8743a6e9d89e7d92d8a3e4eb25fd915c692f26ab49b76c2744047305326b419b7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks