Overview

overview

10

Static

static

10

16624b8d36...bc.exe

windows7_x64

10

16624b8d36...bc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16624b8d3631eb6ca5f721a1ff875bf28c33bcf933bc0d3903868bf5cbd83dbc

  • Size

    80KB

  • Sample

    220212-eh6qnsfgb2

  • MD5

    ed8bf94ea3692f43c7fb813f1b8d7625

  • SHA1

    a7cd476b12addad3f4510b0ef16c72eebe105a05

  • SHA256

    16624b8d3631eb6ca5f721a1ff875bf28c33bcf933bc0d3903868bf5cbd83dbc

  • SHA512

    75d944c423a4d57c64680ed3f55a060b9c1356c471fe801bad944b627aa424e595934071307e19df89ccb9adb5e71a50c5b0e27bbc7c23b4dfc0f1b8b68b4d82

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      16624b8d3631eb6ca5f721a1ff875bf28c33bcf933bc0d3903868bf5cbd83dbc

    • Size

      80KB

    • MD5

      ed8bf94ea3692f43c7fb813f1b8d7625

    • SHA1

      a7cd476b12addad3f4510b0ef16c72eebe105a05

    • SHA256

      16624b8d3631eb6ca5f721a1ff875bf28c33bcf933bc0d3903868bf5cbd83dbc

    • SHA512

      75d944c423a4d57c64680ed3f55a060b9c1356c471fe801bad944b627aa424e595934071307e19df89ccb9adb5e71a50c5b0e27bbc7c23b4dfc0f1b8b68b4d82

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks