Overview

overview

10

Static

static

10

12bcf36cf6...09.exe

windows7_x64

10

12bcf36cf6...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12bcf36cf68e923294f645af90f1a7a21ced8a12450c7aa4b23968c76f513709

  • Size

    150KB

  • Sample

    220212-f43rksgea2

  • MD5

    45dfe1d0b5e770408616130a450af7d6

  • SHA1

    8573d4bd8fa79ae3e8d20c13d65d13768b330795

  • SHA256

    12bcf36cf68e923294f645af90f1a7a21ced8a12450c7aa4b23968c76f513709

  • SHA512

    5a2f7c0ab51b60fcdd4934aa8e438f6eccd4f4bd59ab4655a42ec56fb5dd258d115494a9c5a1ab0b622abde54d5dbce739f86301108796850c73a19049308cbe

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12bcf36cf68e923294f645af90f1a7a21ced8a12450c7aa4b23968c76f513709

    • Size

      150KB

    • MD5

      45dfe1d0b5e770408616130a450af7d6

    • SHA1

      8573d4bd8fa79ae3e8d20c13d65d13768b330795

    • SHA256

      12bcf36cf68e923294f645af90f1a7a21ced8a12450c7aa4b23968c76f513709

    • SHA512

      5a2f7c0ab51b60fcdd4934aa8e438f6eccd4f4bd59ab4655a42ec56fb5dd258d115494a9c5a1ab0b622abde54d5dbce739f86301108796850c73a19049308cbe

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks