Overview

overview

10

Static

static

12f004d470...33.exe

windows7_x64

10

12f004d470...33.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12f004d470e7fe036551ef4951f87bd2bbe2714eaee3a27a4ac9943210ed8633

  • Size

    36KB

  • Sample

    220212-f2lqaagdf6

  • MD5

    49f158e5e90fd43020e50160a6f837c3

  • SHA1

    1b7da0829273944b9be5e4c8065291888f343272

  • SHA256

    12f004d470e7fe036551ef4951f87bd2bbe2714eaee3a27a4ac9943210ed8633

  • SHA512

    8004432700aa38f044176d4acf04dde2bcb9622a21e158429626c353e788d7c3d40671ec52fbaad9f9922746333165066ac32455c0d504e5676d83020b63a868

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12f004d470e7fe036551ef4951f87bd2bbe2714eaee3a27a4ac9943210ed8633

    • Size

      36KB

    • MD5

      49f158e5e90fd43020e50160a6f837c3

    • SHA1

      1b7da0829273944b9be5e4c8065291888f343272

    • SHA256

      12f004d470e7fe036551ef4951f87bd2bbe2714eaee3a27a4ac9943210ed8633

    • SHA512

      8004432700aa38f044176d4acf04dde2bcb9622a21e158429626c353e788d7c3d40671ec52fbaad9f9922746333165066ac32455c0d504e5676d83020b63a868

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks