Overview

overview

10

Static

static

10

16dda042ae...2b.exe

windows7_x64

10

16dda042ae...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b

  • Size

    104KB

  • Sample

    220212-ea47waffb4

  • MD5

    2d4ff13a7d07e781b1ab9dd9e040a2fb

  • SHA1

    c0c62ef131e5ea3573742a3f7c1c62a2185d3cfa

  • SHA256

    16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b

  • SHA512

    1ae9126e75b8652eb07b91ea2b59726810c1ff7f386b13da784fae600837530dc6558d34c1205367b133dda2b34f796ecefba4aeb39e04e7a283ef4ef745661c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b

    • Size

      104KB

    • MD5

      2d4ff13a7d07e781b1ab9dd9e040a2fb

    • SHA1

      c0c62ef131e5ea3573742a3f7c1c62a2185d3cfa

    • SHA256

      16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b

    • SHA512

      1ae9126e75b8652eb07b91ea2b59726810c1ff7f386b13da784fae600837530dc6558d34c1205367b133dda2b34f796ecefba4aeb39e04e7a283ef4ef745661c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks