Overview

overview

10

Static

static

10

161cd6818f...76.exe

windows7_x64

10

161cd6818f...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    161cd6818fd8a9018ebbddf1b54c4350509d0bb137dbc81953b8538a3d3a7876

  • Size

    216KB

  • Sample

    220212-emta5sfge6

  • MD5

    73a7aeefbbc23700fb7ded3d229f957b

  • SHA1

    4310dc9b1def848662d3d78aab4e962e29a5158a

  • SHA256

    161cd6818fd8a9018ebbddf1b54c4350509d0bb137dbc81953b8538a3d3a7876

  • SHA512

    20e69d195b295dc10dc99f84a1f9cb0e8f85d0101ff89d409f295db809e15e2616084bc14f1517d782560db3f013778f5cff9bb81ed89e6a7378f27b00ab5e26

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      161cd6818fd8a9018ebbddf1b54c4350509d0bb137dbc81953b8538a3d3a7876

    • Size

      216KB

    • MD5

      73a7aeefbbc23700fb7ded3d229f957b

    • SHA1

      4310dc9b1def848662d3d78aab4e962e29a5158a

    • SHA256

      161cd6818fd8a9018ebbddf1b54c4350509d0bb137dbc81953b8538a3d3a7876

    • SHA512

      20e69d195b295dc10dc99f84a1f9cb0e8f85d0101ff89d409f295db809e15e2616084bc14f1517d782560db3f013778f5cff9bb81ed89e6a7378f27b00ab5e26

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks