Overview

overview

10

Static

static

10

1655f8f699...18.exe

windows7_x64

10

1655f8f699...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1655f8f699699c19fdc0e84c57cdb0411d3eaaf715a26c85c050f648227b1d18

  • Size

    191KB

  • Sample

    220212-ekepzahcem

  • MD5

    b2c709cf05d71b6ee0c2bb846cd985fe

  • SHA1

    27968431eb993ce3c8bf921083065c0042602b74

  • SHA256

    1655f8f699699c19fdc0e84c57cdb0411d3eaaf715a26c85c050f648227b1d18

  • SHA512

    3f4e562bbeef40e535814ee22db3a2c7bec246c1f24ce3c61c17e0afc2f2b548781f636e8903604aa6b59d24df9d640033394e8cc8a8e9039161ed430c1ee78c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1655f8f699699c19fdc0e84c57cdb0411d3eaaf715a26c85c050f648227b1d18

    • Size

      191KB

    • MD5

      b2c709cf05d71b6ee0c2bb846cd985fe

    • SHA1

      27968431eb993ce3c8bf921083065c0042602b74

    • SHA256

      1655f8f699699c19fdc0e84c57cdb0411d3eaaf715a26c85c050f648227b1d18

    • SHA512

      3f4e562bbeef40e535814ee22db3a2c7bec246c1f24ce3c61c17e0afc2f2b548781f636e8903604aa6b59d24df9d640033394e8cc8a8e9039161ed430c1ee78c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks