Overview

overview

10

Static

static

16cf079cfd...36.exe

windows7_x64

10

16cf079cfd...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16cf079cfd81b78fb4fe50979439f4edbc583539bf3e08e0a118c9092eb69636

  • Size

    60KB

  • Sample

    220212-eb6r4affc4

  • MD5

    d8af75b722f107ff61b90e3b6f760ab9

  • SHA1

    2a0d3b5afa6c8286909810df31b73ada346f3ad5

  • SHA256

    16cf079cfd81b78fb4fe50979439f4edbc583539bf3e08e0a118c9092eb69636

  • SHA512

    fa75eb68743db7b38c16a8b76843cd75eaebeb8a2a03a7f2459e7d6fe3bcac5bd14b3e2bdcacc41dae3053370896fb30ff2529923add85a23d56612faa6cba8e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16cf079cfd81b78fb4fe50979439f4edbc583539bf3e08e0a118c9092eb69636

    • Size

      60KB

    • MD5

      d8af75b722f107ff61b90e3b6f760ab9

    • SHA1

      2a0d3b5afa6c8286909810df31b73ada346f3ad5

    • SHA256

      16cf079cfd81b78fb4fe50979439f4edbc583539bf3e08e0a118c9092eb69636

    • SHA512

      fa75eb68743db7b38c16a8b76843cd75eaebeb8a2a03a7f2459e7d6fe3bcac5bd14b3e2bdcacc41dae3053370896fb30ff2529923add85a23d56612faa6cba8e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks