Overview

overview

10

Static

static

10

1682bfc244...fa.exe

windows7_x64

10

1682bfc244...fa.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1682bfc244ab0e901700c28c9a2a5e3510b01dd1dc9ec1c0275bbd4daba95afa

  • Size

    216KB

  • Sample

    220212-egln4sffh3

  • MD5

    89be9914086ad4fd24250dfa4e9b2cd9

  • SHA1

    8bfd4b3b7cd70a1be8027a9b82acb3263197aeca

  • SHA256

    1682bfc244ab0e901700c28c9a2a5e3510b01dd1dc9ec1c0275bbd4daba95afa

  • SHA512

    27afd02fb1d7aa98aa8ed11dd8ac910a37385d5e7e6fda70e0373b694310294ddd3f4e1ed5126f70669727614dc3be1a0730546579ff9c16962896ece25c1caf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1682bfc244ab0e901700c28c9a2a5e3510b01dd1dc9ec1c0275bbd4daba95afa

    • Size

      216KB

    • MD5

      89be9914086ad4fd24250dfa4e9b2cd9

    • SHA1

      8bfd4b3b7cd70a1be8027a9b82acb3263197aeca

    • SHA256

      1682bfc244ab0e901700c28c9a2a5e3510b01dd1dc9ec1c0275bbd4daba95afa

    • SHA512

      27afd02fb1d7aa98aa8ed11dd8ac910a37385d5e7e6fda70e0373b694310294ddd3f4e1ed5126f70669727614dc3be1a0730546579ff9c16962896ece25c1caf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks