Overview

overview

10

Static

static

10

166804a915...33.exe

windows7_x64

10

166804a915...33.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    166804a91557ced3df5d91e79c35fef0a9ac9e713cfc3015f9b3ad5f3f9b1e33

  • Size

    99KB

  • Sample

    220212-ehr8aafga7

  • MD5

    36a220c06e4284bc08511de788efd127

  • SHA1

    6343063700617c369ad1057303f4750cf8d58b62

  • SHA256

    166804a91557ced3df5d91e79c35fef0a9ac9e713cfc3015f9b3ad5f3f9b1e33

  • SHA512

    14fbcf69b1dacc46482ce2df4e6a0d531718de2080f9ccf411c7a66f299152ce6e3a85f3bbdf4b0b51df531b125ad67a215e35c73e6b0d56d2426dcead766251

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      166804a91557ced3df5d91e79c35fef0a9ac9e713cfc3015f9b3ad5f3f9b1e33

    • Size

      99KB

    • MD5

      36a220c06e4284bc08511de788efd127

    • SHA1

      6343063700617c369ad1057303f4750cf8d58b62

    • SHA256

      166804a91557ced3df5d91e79c35fef0a9ac9e713cfc3015f9b3ad5f3f9b1e33

    • SHA512

      14fbcf69b1dacc46482ce2df4e6a0d531718de2080f9ccf411c7a66f299152ce6e3a85f3bbdf4b0b51df531b125ad67a215e35c73e6b0d56d2426dcead766251

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks