Overview

overview

10

Static

static

1591561d38...06.exe

windows7_x64

10

1591561d38...06.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1591561d3896de7a821fdc18715334d6bbdfaaffb53e9bcd141484cbf9f25b06

  • Size

    60KB

  • Sample

    220212-eww4dshdhn

  • MD5

    21647921c9d30dcdc96c4d81dd6b49cb

  • SHA1

    de052a18f528b75f33f4ccf804302cf616c2bc0d

  • SHA256

    1591561d3896de7a821fdc18715334d6bbdfaaffb53e9bcd141484cbf9f25b06

  • SHA512

    a128fed5d634daec1f74f07cf40ed7175c93f993bb5c209b8006f58197df861b7302eba415ed7eaf39f662f34bb743e274c2db586f19aba1d64980f3aeb2a0d8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1591561d3896de7a821fdc18715334d6bbdfaaffb53e9bcd141484cbf9f25b06

    • Size

      60KB

    • MD5

      21647921c9d30dcdc96c4d81dd6b49cb

    • SHA1

      de052a18f528b75f33f4ccf804302cf616c2bc0d

    • SHA256

      1591561d3896de7a821fdc18715334d6bbdfaaffb53e9bcd141484cbf9f25b06

    • SHA512

      a128fed5d634daec1f74f07cf40ed7175c93f993bb5c209b8006f58197df861b7302eba415ed7eaf39f662f34bb743e274c2db586f19aba1d64980f3aeb2a0d8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks