Overview

overview

10

Static

static

16c76bedb5...78.exe

windows7_x64

10

16c76bedb5...78.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16c76bedb552d517b05e4fcb068e1c475a72ff0c06989442e2f08ee87b92f578

  • Size

    36KB

  • Sample

    220212-ecep1ahbfk

  • MD5

    81a0c5ea1290721902d384cb762d6e89

  • SHA1

    0afeb8bf3ed44cd45015fc712f196ea82a484d05

  • SHA256

    16c76bedb552d517b05e4fcb068e1c475a72ff0c06989442e2f08ee87b92f578

  • SHA512

    0b6fa8b1a1f265b9b7bbb8f7f1054d4f131beec3b33fdafad2a029988f89fd3f6b5e0c0c47fbe962bcabf14d1f88326cac9ce0e6cc825f9cf735d61ab49d38f3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16c76bedb552d517b05e4fcb068e1c475a72ff0c06989442e2f08ee87b92f578

    • Size

      36KB

    • MD5

      81a0c5ea1290721902d384cb762d6e89

    • SHA1

      0afeb8bf3ed44cd45015fc712f196ea82a484d05

    • SHA256

      16c76bedb552d517b05e4fcb068e1c475a72ff0c06989442e2f08ee87b92f578

    • SHA512

      0b6fa8b1a1f265b9b7bbb8f7f1054d4f131beec3b33fdafad2a029988f89fd3f6b5e0c0c47fbe962bcabf14d1f88326cac9ce0e6cc825f9cf735d61ab49d38f3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks