Overview

overview

10

Static

static

10

16a6bee673...ae.exe

windows7_x64

10

16a6bee673...ae.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16a6bee673b0a851d90eb47c2435edafe6ea4d4dc8cb76f2a66004f29d4798ae

  • Size

    92KB

  • Sample

    220212-eez4qafff2

  • MD5

    6d8e0f83dc0ff040f160055099ad3390

  • SHA1

    c0ed0d10fab12fe838ac9b9ee4c95b5e1027b3cc

  • SHA256

    16a6bee673b0a851d90eb47c2435edafe6ea4d4dc8cb76f2a66004f29d4798ae

  • SHA512

    bff1e40d81358542a755e2592959d8974683716428f8b30c74b9c0e7057f3e3816f982094b2e900e5fa8ba83ed60638d66494958154abfbc36e521bc6503bb36

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16a6bee673b0a851d90eb47c2435edafe6ea4d4dc8cb76f2a66004f29d4798ae

    • Size

      92KB

    • MD5

      6d8e0f83dc0ff040f160055099ad3390

    • SHA1

      c0ed0d10fab12fe838ac9b9ee4c95b5e1027b3cc

    • SHA256

      16a6bee673b0a851d90eb47c2435edafe6ea4d4dc8cb76f2a66004f29d4798ae

    • SHA512

      bff1e40d81358542a755e2592959d8974683716428f8b30c74b9c0e7057f3e3816f982094b2e900e5fa8ba83ed60638d66494958154abfbc36e521bc6503bb36

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks