Overview

overview

10

Static

static

160ecbf7ca...ee.exe

windows7_x64

10

160ecbf7ca...ee.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    160ecbf7ca227519b3fb2b32e52ff641d1e96c84ea6b08db3d470b13180b50ee

  • Size

    60KB

  • Sample

    220212-en4hhahdak

  • MD5

    1a8a652b0ca829f9cbbde5df1d3c4bba

  • SHA1

    f6bf01e5665d30b20e4dd6908033cb33e5e935d8

  • SHA256

    160ecbf7ca227519b3fb2b32e52ff641d1e96c84ea6b08db3d470b13180b50ee

  • SHA512

    6d8c3208ef12d75cdfb29cd1b136225ac301391682af8a1359fe44df62ee9acd5ed55ce0118439346e7748e6404111e9036cba8066a171778c9a0d1674e05212

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      160ecbf7ca227519b3fb2b32e52ff641d1e96c84ea6b08db3d470b13180b50ee

    • Size

      60KB

    • MD5

      1a8a652b0ca829f9cbbde5df1d3c4bba

    • SHA1

      f6bf01e5665d30b20e4dd6908033cb33e5e935d8

    • SHA256

      160ecbf7ca227519b3fb2b32e52ff641d1e96c84ea6b08db3d470b13180b50ee

    • SHA512

      6d8c3208ef12d75cdfb29cd1b136225ac301391682af8a1359fe44df62ee9acd5ed55ce0118439346e7748e6404111e9036cba8066a171778c9a0d1674e05212

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks