Overview

overview

10

Static

static

10

14f7ef3775...3c.exe

windows7_x64

10

14f7ef3775...3c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14f7ef37754b4287d6e7052dd78c8bd9a1e3bfca64cac11056cf5196c1fd313c

  • Size

    192KB

  • Sample

    220212-e9jefshfbm

  • MD5

    7f538a0bfe1bcc3306327cf998115bb8

  • SHA1

    7e415c9a6e67f45c6bca53fb7bb1ecd0827f9e59

  • SHA256

    14f7ef37754b4287d6e7052dd78c8bd9a1e3bfca64cac11056cf5196c1fd313c

  • SHA512

    77c5f18436bfb03b1f168d678001c7f9a197a5a13b040286b6aeb97d460335bde2d545e86971e5d70963a5934a4f56cfc6f77f1c0f2e18340d906cb75c30f65f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14f7ef37754b4287d6e7052dd78c8bd9a1e3bfca64cac11056cf5196c1fd313c

    • Size

      192KB

    • MD5

      7f538a0bfe1bcc3306327cf998115bb8

    • SHA1

      7e415c9a6e67f45c6bca53fb7bb1ecd0827f9e59

    • SHA256

      14f7ef37754b4287d6e7052dd78c8bd9a1e3bfca64cac11056cf5196c1fd313c

    • SHA512

      77c5f18436bfb03b1f168d678001c7f9a197a5a13b040286b6aeb97d460335bde2d545e86971e5d70963a5934a4f56cfc6f77f1c0f2e18340d906cb75c30f65f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks