Overview

overview

10

Static

static

161b1c3a9f...7e.exe

windows7_x64

10

161b1c3a9f...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    161b1c3a9f35bddf59477806dec48b175c1b9025cb0663d3de40a004bce4787e

  • Size

    35KB

  • Sample

    220212-em1efsfge7

  • MD5

    754df238e8899bf1902e0d46af034c69

  • SHA1

    5f3268b478c885d5c3eaa5d2246c9a2e02b1c576

  • SHA256

    161b1c3a9f35bddf59477806dec48b175c1b9025cb0663d3de40a004bce4787e

  • SHA512

    6fde867c33edf90c5d1178d19dd8004f2239f81ff49062daeb3816ef72ea0f03e12bcb116390f162b5a693e72c20b5d036c41f36d76b01659b0463ad2ccc5cce

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      161b1c3a9f35bddf59477806dec48b175c1b9025cb0663d3de40a004bce4787e

    • Size

      35KB

    • MD5

      754df238e8899bf1902e0d46af034c69

    • SHA1

      5f3268b478c885d5c3eaa5d2246c9a2e02b1c576

    • SHA256

      161b1c3a9f35bddf59477806dec48b175c1b9025cb0663d3de40a004bce4787e

    • SHA512

      6fde867c33edf90c5d1178d19dd8004f2239f81ff49062daeb3816ef72ea0f03e12bcb116390f162b5a693e72c20b5d036c41f36d76b01659b0463ad2ccc5cce

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks