Overview

overview

10

Static

static

166a1b6be3...1a.exe

windows7_x64

10

166a1b6be3...1a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    166a1b6be385b9d0660b7d70abe5e8db6142420c28b9665178e95bda08de161a

  • Size

    36KB

  • Sample

    220212-ehp3xshccl

  • MD5

    dbd7e1e079e3a7d474e1e2c7f0881a51

  • SHA1

    2335d6a6837ce2a28936d70afcc07757fb5834f2

  • SHA256

    166a1b6be385b9d0660b7d70abe5e8db6142420c28b9665178e95bda08de161a

  • SHA512

    7ab153f83839d28f5c4123928dbd6b16192abd5a4c907ecf19c92b993c14cc23a33d1c68608380778e32c753a9e15c1503356bf22dee3c06191b5f962065d862

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      166a1b6be385b9d0660b7d70abe5e8db6142420c28b9665178e95bda08de161a

    • Size

      36KB

    • MD5

      dbd7e1e079e3a7d474e1e2c7f0881a51

    • SHA1

      2335d6a6837ce2a28936d70afcc07757fb5834f2

    • SHA256

      166a1b6be385b9d0660b7d70abe5e8db6142420c28b9665178e95bda08de161a

    • SHA512

      7ab153f83839d28f5c4123928dbd6b16192abd5a4c907ecf19c92b993c14cc23a33d1c68608380778e32c753a9e15c1503356bf22dee3c06191b5f962065d862

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks