Overview

overview

10

Static

static

10

16a6f62d17...ec.exe

windows7_x64

10

16a6f62d17...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16a6f62d1792c035cb58d6419575b278e6b246b505b207a75540f14ac1ec7eec

  • Size

    101KB

  • Sample

    220212-eevh8shcak

  • MD5

    3e1c544b9b1c4ebda7b9c820c6a56c0e

  • SHA1

    49fceb5b811bef494632397614fb19dea5ba3b19

  • SHA256

    16a6f62d1792c035cb58d6419575b278e6b246b505b207a75540f14ac1ec7eec

  • SHA512

    694dc2d978a7e7d347026874ae77671eb8e995ccf0395810d43c7f903ff165a3739bc1ac4a445528e58808ae73e4d394eae819a14f9396e495be49cc4224d64c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16a6f62d1792c035cb58d6419575b278e6b246b505b207a75540f14ac1ec7eec

    • Size

      101KB

    • MD5

      3e1c544b9b1c4ebda7b9c820c6a56c0e

    • SHA1

      49fceb5b811bef494632397614fb19dea5ba3b19

    • SHA256

      16a6f62d1792c035cb58d6419575b278e6b246b505b207a75540f14ac1ec7eec

    • SHA512

      694dc2d978a7e7d347026874ae77671eb8e995ccf0395810d43c7f903ff165a3739bc1ac4a445528e58808ae73e4d394eae819a14f9396e495be49cc4224d64c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks