Overview

overview

10

Static

static

10

1689435056...38.exe

windows7_x64

10

1689435056...38.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16894350560b098918ce4fa412db16ba8cc82294f016705a9f14ea66a0da7c38

  • Size

    192KB

  • Sample

    220212-ef6b5ahcbj

  • MD5

    b2cbdb0159dc460c0fc77ad43bea9a76

  • SHA1

    70a373172cbf1e09bdd1257444fb66cd181b2b44

  • SHA256

    16894350560b098918ce4fa412db16ba8cc82294f016705a9f14ea66a0da7c38

  • SHA512

    0cdfa532048506913a76f84648fbe2f6a24fbefa3b7e647d033b73d2cdd2e3ac6602428db942ed73cba2681c32f65cff95d0a08800d23bd3699b95117ffbea22

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16894350560b098918ce4fa412db16ba8cc82294f016705a9f14ea66a0da7c38

    • Size

      192KB

    • MD5

      b2cbdb0159dc460c0fc77ad43bea9a76

    • SHA1

      70a373172cbf1e09bdd1257444fb66cd181b2b44

    • SHA256

      16894350560b098918ce4fa412db16ba8cc82294f016705a9f14ea66a0da7c38

    • SHA512

      0cdfa532048506913a76f84648fbe2f6a24fbefa3b7e647d033b73d2cdd2e3ac6602428db942ed73cba2681c32f65cff95d0a08800d23bd3699b95117ffbea22

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks