Overview

overview

10

Static

static

16b5a2a31a...98.exe

windows7_x64

10

16b5a2a31a...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16b5a2a31a643beb7522dbbce8cb5b44482403d4f41c5d111b0d32ee2988eb98

  • Size

    58KB

  • Sample

    220212-edqtnahbhj

  • MD5

    c3643b06640a0f03fcf41b48d1f6cda8

  • SHA1

    8608e04b22992ea35c4a34b1a1ac5740fdcbec9d

  • SHA256

    16b5a2a31a643beb7522dbbce8cb5b44482403d4f41c5d111b0d32ee2988eb98

  • SHA512

    31a0ef4810f95e4027e560d8d5482f6e529f8106ea56d3c4e525c66d529cd67354e63538d0eaa9ee7789cf4acd6e430dd0efdfe21d7ac4e1baa177c1e3e6fc02

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16b5a2a31a643beb7522dbbce8cb5b44482403d4f41c5d111b0d32ee2988eb98

    • Size

      58KB

    • MD5

      c3643b06640a0f03fcf41b48d1f6cda8

    • SHA1

      8608e04b22992ea35c4a34b1a1ac5740fdcbec9d

    • SHA256

      16b5a2a31a643beb7522dbbce8cb5b44482403d4f41c5d111b0d32ee2988eb98

    • SHA512

      31a0ef4810f95e4027e560d8d5482f6e529f8106ea56d3c4e525c66d529cd67354e63538d0eaa9ee7789cf4acd6e430dd0efdfe21d7ac4e1baa177c1e3e6fc02

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks