Overview

overview

10

Static

static

10

16ae52dcf9...cb.exe

windows7_x64

10

16ae52dcf9...cb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16ae52dcf929901c6060f546dbe41a253e581fd6a441e7f3c64a24daeaa12dcb

  • Size

    99KB

  • Sample

    220212-eed69affe4

  • MD5

    5e9b5ebf605ac6de326131f6d1d998b1

  • SHA1

    719eb6da5e265889c33a43ef1dfdd0a6ed380ea7

  • SHA256

    16ae52dcf929901c6060f546dbe41a253e581fd6a441e7f3c64a24daeaa12dcb

  • SHA512

    3c1e6e7676cff52073760d285cfd8dba31cb2ef35810c72b22c68f5fc3c2afc481a0c702e82030855a3d0ad3581ee75e1f9cfee21aee7a120f8c97162bec655d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16ae52dcf929901c6060f546dbe41a253e581fd6a441e7f3c64a24daeaa12dcb

    • Size

      99KB

    • MD5

      5e9b5ebf605ac6de326131f6d1d998b1

    • SHA1

      719eb6da5e265889c33a43ef1dfdd0a6ed380ea7

    • SHA256

      16ae52dcf929901c6060f546dbe41a253e581fd6a441e7f3c64a24daeaa12dcb

    • SHA512

      3c1e6e7676cff52073760d285cfd8dba31cb2ef35810c72b22c68f5fc3c2afc481a0c702e82030855a3d0ad3581ee75e1f9cfee21aee7a120f8c97162bec655d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks