Overview

overview

10

Static

static

161fbb79af...f8.exe

windows7_x64

10

161fbb79af...f8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    161fbb79af0570ddcf8a091ecd9f1495938ada111e702517d6854d36c46890f8

  • Size

    58KB

  • Sample

    220212-emjrpshcgk

  • MD5

    73770668f92a851c43b8f63ed50a2ca9

  • SHA1

    58455f17b5c62790f0ce2eeab899799ecd403967

  • SHA256

    161fbb79af0570ddcf8a091ecd9f1495938ada111e702517d6854d36c46890f8

  • SHA512

    bad8ac95c779facb60f4e0679ff56eb652f7e71cd566967f6c1f2ff056efce9efa640a9826ad8ee3f093bbff84575fefde8a4b8baed3b9d9f30462bfb3f8d9d6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      161fbb79af0570ddcf8a091ecd9f1495938ada111e702517d6854d36c46890f8

    • Size

      58KB

    • MD5

      73770668f92a851c43b8f63ed50a2ca9

    • SHA1

      58455f17b5c62790f0ce2eeab899799ecd403967

    • SHA256

      161fbb79af0570ddcf8a091ecd9f1495938ada111e702517d6854d36c46890f8

    • SHA512

      bad8ac95c779facb60f4e0679ff56eb652f7e71cd566967f6c1f2ff056efce9efa640a9826ad8ee3f093bbff84575fefde8a4b8baed3b9d9f30462bfb3f8d9d6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks