Overview

overview

10

Static

static

16a99046ad...f4.exe

windows7_x64

10

16a99046ad...f4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16a99046ad0b2e9eb36dca995b54effbb45c1d7d67b1e8d54a021d9393164bf4

  • Size

    36KB

  • Sample

    220212-eejfzaffe5

  • MD5

    23119c66a8630a47b3056d58de65af9e

  • SHA1

    86ba539a5ebe214e4599075209960bd6414145c6

  • SHA256

    16a99046ad0b2e9eb36dca995b54effbb45c1d7d67b1e8d54a021d9393164bf4

  • SHA512

    72732e8a9344081e9e27f45145535d67a3a5abefe7ac3dfa156f1cf07cf33a00ebbcf5afed32398aeaddcbc34aba04e9deaac9b71a7facbed60a32e8f5a1eb57

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16a99046ad0b2e9eb36dca995b54effbb45c1d7d67b1e8d54a021d9393164bf4

    • Size

      36KB

    • MD5

      23119c66a8630a47b3056d58de65af9e

    • SHA1

      86ba539a5ebe214e4599075209960bd6414145c6

    • SHA256

      16a99046ad0b2e9eb36dca995b54effbb45c1d7d67b1e8d54a021d9393164bf4

    • SHA512

      72732e8a9344081e9e27f45145535d67a3a5abefe7ac3dfa156f1cf07cf33a00ebbcf5afed32398aeaddcbc34aba04e9deaac9b71a7facbed60a32e8f5a1eb57

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks