Overview

overview

10

Static

static

10

16b5f31a57...88.exe

windows7_x64

10

16b5f31a57...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16b5f31a57b09921d05c56f4c69ddda2eaf5b83c50e5bdf7ffc65bb043368d88

  • Size

    99KB

  • Sample

    220212-edf98affd6

  • MD5

    5b6ea751a75567561c335096266bca32

  • SHA1

    513ecbe9d01061b48f4fc13ce96ed6f116cf433a

  • SHA256

    16b5f31a57b09921d05c56f4c69ddda2eaf5b83c50e5bdf7ffc65bb043368d88

  • SHA512

    04cde9fcc8f4a760d995b2d8a98586a27986110dc6e8cc3a0e5c522c30b39f1f84c3819d59843564d7bea552d8e71a03ef7970c8da543b86fc04b55c4400d2bd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16b5f31a57b09921d05c56f4c69ddda2eaf5b83c50e5bdf7ffc65bb043368d88

    • Size

      99KB

    • MD5

      5b6ea751a75567561c335096266bca32

    • SHA1

      513ecbe9d01061b48f4fc13ce96ed6f116cf433a

    • SHA256

      16b5f31a57b09921d05c56f4c69ddda2eaf5b83c50e5bdf7ffc65bb043368d88

    • SHA512

      04cde9fcc8f4a760d995b2d8a98586a27986110dc6e8cc3a0e5c522c30b39f1f84c3819d59843564d7bea552d8e71a03ef7970c8da543b86fc04b55c4400d2bd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks