Overview

overview

10

Static

static

10

16e44b9bf8...48.exe

windows7_x64

10

16e44b9bf8...48.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16e44b9bf85e5eb9de102e2720f89b40aa98c9648e7e1575d861bfa81ca91d48

  • Size

    176KB

  • Sample

    220212-ean6naffa9

  • MD5

    be27d677429d7f7792b1ce478afc528f

  • SHA1

    c0d303f8b2afa038944e657e5af7f99eb4c1d58d

  • SHA256

    16e44b9bf85e5eb9de102e2720f89b40aa98c9648e7e1575d861bfa81ca91d48

  • SHA512

    7336cd9d2d5a8aed9788f3674c83e2e60385dc2c975e1b3b9d7acb9e4a9dd65749df8b50d66550c93d60ad776e11c0f990b1976a8f4dd2b960c1a6497cf64fb1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16e44b9bf85e5eb9de102e2720f89b40aa98c9648e7e1575d861bfa81ca91d48

    • Size

      176KB

    • MD5

      be27d677429d7f7792b1ce478afc528f

    • SHA1

      c0d303f8b2afa038944e657e5af7f99eb4c1d58d

    • SHA256

      16e44b9bf85e5eb9de102e2720f89b40aa98c9648e7e1575d861bfa81ca91d48

    • SHA512

      7336cd9d2d5a8aed9788f3674c83e2e60385dc2c975e1b3b9d7acb9e4a9dd65749df8b50d66550c93d60ad776e11c0f990b1976a8f4dd2b960c1a6497cf64fb1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks