Overview

overview

10

Static

static

16ddc01759...47.exe

windows7_x64

10

16ddc01759...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16ddc017593c5b9a2841c9ee940d844a36c9ad27102f22d3e40159c37bcdb947

  • Size

    35KB

  • Sample

    220212-eaz8xshbdr

  • MD5

    71858d7e3b264703a830a7cb40a5dd80

  • SHA1

    44581fb5e739f86ef053760df15584e4a8451904

  • SHA256

    16ddc017593c5b9a2841c9ee940d844a36c9ad27102f22d3e40159c37bcdb947

  • SHA512

    afc0d9c0057328d56619afaf1ad2321f39f0f3506b8aa81d86635437f60a422e1830b14799c977765f65c6ba50d0a41b5920c3720999fc17547a382df8c1f2a3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16ddc017593c5b9a2841c9ee940d844a36c9ad27102f22d3e40159c37bcdb947

    • Size

      35KB

    • MD5

      71858d7e3b264703a830a7cb40a5dd80

    • SHA1

      44581fb5e739f86ef053760df15584e4a8451904

    • SHA256

      16ddc017593c5b9a2841c9ee940d844a36c9ad27102f22d3e40159c37bcdb947

    • SHA512

      afc0d9c0057328d56619afaf1ad2321f39f0f3506b8aa81d86635437f60a422e1830b14799c977765f65c6ba50d0a41b5920c3720999fc17547a382df8c1f2a3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks