Overview

overview

10

Static

static

10

163fcc980f...c4.exe

windows7_x64

10

163fcc980f...c4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    163fcc980faf6b34b2ed39667d2c6ad575b6615d6ec7554186ce064a10cbdfc4

  • Size

    216KB

  • Sample

    220212-elscfsfgd8

  • MD5

    9caf419778f4105545dfcc8b181bbf8e

  • SHA1

    4052e9517a1a2065fc9c9ada6e59750f84fc22a6

  • SHA256

    163fcc980faf6b34b2ed39667d2c6ad575b6615d6ec7554186ce064a10cbdfc4

  • SHA512

    2fc48dbafe1e4519de372afdbd90d3d814667946a9a73b82880af1149812c54c41deecbf6277973de9ac520fea2d34ff08038b7b770a3dfd10e6a45b77c4ddfb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      163fcc980faf6b34b2ed39667d2c6ad575b6615d6ec7554186ce064a10cbdfc4

    • Size

      216KB

    • MD5

      9caf419778f4105545dfcc8b181bbf8e

    • SHA1

      4052e9517a1a2065fc9c9ada6e59750f84fc22a6

    • SHA256

      163fcc980faf6b34b2ed39667d2c6ad575b6615d6ec7554186ce064a10cbdfc4

    • SHA512

      2fc48dbafe1e4519de372afdbd90d3d814667946a9a73b82880af1149812c54c41deecbf6277973de9ac520fea2d34ff08038b7b770a3dfd10e6a45b77c4ddfb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks