Overview

overview

10

Static

static

12ce6ea6ac...07.exe

windows7_x64

10

12ce6ea6ac...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12ce6ea6ac87b8e427ae99bf85b6473a6c4b68ab5462e9fbb741350a0b773207

  • Size

    60KB

  • Sample

    220212-f4cv6aaagj

  • MD5

    ff0b9561b6d4fd95691220e522d07beb

  • SHA1

    d4524e79a1dfd170c1bad51b7408d37532c4ad6f

  • SHA256

    12ce6ea6ac87b8e427ae99bf85b6473a6c4b68ab5462e9fbb741350a0b773207

  • SHA512

    52cbda774082e1ca47e2a4d5b0742c1d07167546d7d7ad1ebf7236d8e713cce9f0f0847834212bdd0a57b0b51770e98e36101abd38819beaa482ee63ce5129bf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12ce6ea6ac87b8e427ae99bf85b6473a6c4b68ab5462e9fbb741350a0b773207

    • Size

      60KB

    • MD5

      ff0b9561b6d4fd95691220e522d07beb

    • SHA1

      d4524e79a1dfd170c1bad51b7408d37532c4ad6f

    • SHA256

      12ce6ea6ac87b8e427ae99bf85b6473a6c4b68ab5462e9fbb741350a0b773207

    • SHA512

      52cbda774082e1ca47e2a4d5b0742c1d07167546d7d7ad1ebf7236d8e713cce9f0f0847834212bdd0a57b0b51770e98e36101abd38819beaa482ee63ce5129bf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks