Overview

overview

10

Static

static

10

16d974437a...20.exe

windows7_x64

10

16d974437a...20.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16d974437a0bdebf4ef1c12334f34d5eeb09c8f678b5051ae08dd99d61e13c20

  • Size

    216KB

  • Sample

    220212-ea9glaffb5

  • MD5

    14ee3cb56fda7c35536f9cdfef5a6ca2

  • SHA1

    a378ff50cc4138c21d00ce94dcd50de466fd350f

  • SHA256

    16d974437a0bdebf4ef1c12334f34d5eeb09c8f678b5051ae08dd99d61e13c20

  • SHA512

    c0c37b30b5121be490fc3243c57ef251855fd35fcd1ca30d86ed62a420e956c263bd50b2ddfa9fe6a02777c9cdf89d23fa9d33cbec682e0f5f9b48080aa4ed5b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16d974437a0bdebf4ef1c12334f34d5eeb09c8f678b5051ae08dd99d61e13c20

    • Size

      216KB

    • MD5

      14ee3cb56fda7c35536f9cdfef5a6ca2

    • SHA1

      a378ff50cc4138c21d00ce94dcd50de466fd350f

    • SHA256

      16d974437a0bdebf4ef1c12334f34d5eeb09c8f678b5051ae08dd99d61e13c20

    • SHA512

      c0c37b30b5121be490fc3243c57ef251855fd35fcd1ca30d86ed62a420e956c263bd50b2ddfa9fe6a02777c9cdf89d23fa9d33cbec682e0f5f9b48080aa4ed5b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks