Overview

overview

10

Static

static

166e7d8daf...8b.exe

windows7_x64

10

166e7d8daf...8b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    166e7d8daf8c94462f2b37436ce7dd9e4cdc389097b2b800f33c450f2a87288b

  • Size

    60KB

  • Sample

    220212-ehe8qafga4

  • MD5

    68d084653c357bb4d3028f594da2b0fa

  • SHA1

    2b491b4ee133e8ae4936950a31301f24d3e26398

  • SHA256

    166e7d8daf8c94462f2b37436ce7dd9e4cdc389097b2b800f33c450f2a87288b

  • SHA512

    e46d17049543bbd24b80368952671a75cef4d4d95847ae31ad61375cc9c3ccfa8e2ff1d8c2b054be72c7192c7e81c62c0d08f64317f00abd6953c96f9d4ceef9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      166e7d8daf8c94462f2b37436ce7dd9e4cdc389097b2b800f33c450f2a87288b

    • Size

      60KB

    • MD5

      68d084653c357bb4d3028f594da2b0fa

    • SHA1

      2b491b4ee133e8ae4936950a31301f24d3e26398

    • SHA256

      166e7d8daf8c94462f2b37436ce7dd9e4cdc389097b2b800f33c450f2a87288b

    • SHA512

      e46d17049543bbd24b80368952671a75cef4d4d95847ae31ad61375cc9c3ccfa8e2ff1d8c2b054be72c7192c7e81c62c0d08f64317f00abd6953c96f9d4ceef9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks