Overview

overview

10

Static

static

10

12e2bfbf29...47.exe

windows7_x64

10

12e2bfbf29...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12e2bfbf292ba09400bfa63ebbe278d5edd60015f67d1b15730b7692729d9d47

  • Size

    172KB

  • Sample

    220212-f29gcagdg3

  • MD5

    00eebad47b12282a057f7b6f9696910c

  • SHA1

    39595bb93837ae147e191654c8dfdb0950456239

  • SHA256

    12e2bfbf292ba09400bfa63ebbe278d5edd60015f67d1b15730b7692729d9d47

  • SHA512

    b8aa1fd57e6cd15e4dd17d75287711ea50445651106818778b8a5b222af588a59f4be9de0790a89e7e0b00be1bcd5db9554ff80710f314d983f584edb240dd19

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12e2bfbf292ba09400bfa63ebbe278d5edd60015f67d1b15730b7692729d9d47

    • Size

      172KB

    • MD5

      00eebad47b12282a057f7b6f9696910c

    • SHA1

      39595bb93837ae147e191654c8dfdb0950456239

    • SHA256

      12e2bfbf292ba09400bfa63ebbe278d5edd60015f67d1b15730b7692729d9d47

    • SHA512

      b8aa1fd57e6cd15e4dd17d75287711ea50445651106818778b8a5b222af588a59f4be9de0790a89e7e0b00be1bcd5db9554ff80710f314d983f584edb240dd19

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks