Overview

overview

10

Static

static

10

1698a7f0eb...c2.exe

windows7_x64

10

1698a7f0eb...c2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1698a7f0ebf4ad9583322b820037c59e814fe90842e21e9897d333f99def02c2

  • Size

    108KB

  • Sample

    220212-efkenahcaq

  • MD5

    59a934c605171db02d306161a302dab9

  • SHA1

    0929c137bb7cd6900d8405b0d8e41a9a56169488

  • SHA256

    1698a7f0ebf4ad9583322b820037c59e814fe90842e21e9897d333f99def02c2

  • SHA512

    c77af50c690ef8ca1b56c51c2583834b0c264d979eeca7dbb8b0d4d57f7b4c7e737325fd14bca5e2676d7a58ef8f1c1157ec4a442ce006109f193f65070ff8dc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1698a7f0ebf4ad9583322b820037c59e814fe90842e21e9897d333f99def02c2

    • Size

      108KB

    • MD5

      59a934c605171db02d306161a302dab9

    • SHA1

      0929c137bb7cd6900d8405b0d8e41a9a56169488

    • SHA256

      1698a7f0ebf4ad9583322b820037c59e814fe90842e21e9897d333f99def02c2

    • SHA512

      c77af50c690ef8ca1b56c51c2583834b0c264d979eeca7dbb8b0d4d57f7b4c7e737325fd14bca5e2676d7a58ef8f1c1157ec4a442ce006109f193f65070ff8dc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks