Overview

overview

10

Static

static

167efe34a0...00.exe

windows7_x64

10

167efe34a0...00.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    167efe34a0ab97a47c2a58d737f9095b0c521b9e0e84ff560e1517a03293b700

  • Size

    60KB

  • Sample

    220212-egsseshcbq

  • MD5

    0588049758b873bf5b3c3d3157942e91

  • SHA1

    76f5a6bd6c4432fa9818c040eec7f1b063d07d2a

  • SHA256

    167efe34a0ab97a47c2a58d737f9095b0c521b9e0e84ff560e1517a03293b700

  • SHA512

    df27826b0d62b12860941f328f2651b08e28f4b49d632e446d5deee1847a85a6cfb514d62d2803848aa2b2b054600d3058811c94b114178a6235ed2d90741e0d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      167efe34a0ab97a47c2a58d737f9095b0c521b9e0e84ff560e1517a03293b700

    • Size

      60KB

    • MD5

      0588049758b873bf5b3c3d3157942e91

    • SHA1

      76f5a6bd6c4432fa9818c040eec7f1b063d07d2a

    • SHA256

      167efe34a0ab97a47c2a58d737f9095b0c521b9e0e84ff560e1517a03293b700

    • SHA512

      df27826b0d62b12860941f328f2651b08e28f4b49d632e446d5deee1847a85a6cfb514d62d2803848aa2b2b054600d3058811c94b114178a6235ed2d90741e0d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks