Overview

overview

10

Static

static

10

12ac35e35f...ff.exe

windows7_x64

10

12ac35e35f...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12ac35e35ff247d89a35afffe065639ec0c61862d15e79df2361ca61a872aaff

  • Size

    79KB

  • Sample

    220212-f51cvaaahn

  • MD5

    52996ba6234d7f7c743a021ef84d6c1e

  • SHA1

    4b4d1f4eed3494d279c9145926da8f97e48024cd

  • SHA256

    12ac35e35ff247d89a35afffe065639ec0c61862d15e79df2361ca61a872aaff

  • SHA512

    ae1cda21d416e1adc0d20b637e647719a199bba868500d62edc8557fa3c2144a314ace01933d735cf5eb2a4ea9f0b79a89df8d4cf6abe810af6de6d74c330c3b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12ac35e35ff247d89a35afffe065639ec0c61862d15e79df2361ca61a872aaff

    • Size

      79KB

    • MD5

      52996ba6234d7f7c743a021ef84d6c1e

    • SHA1

      4b4d1f4eed3494d279c9145926da8f97e48024cd

    • SHA256

      12ac35e35ff247d89a35afffe065639ec0c61862d15e79df2361ca61a872aaff

    • SHA512

      ae1cda21d416e1adc0d20b637e647719a199bba868500d62edc8557fa3c2144a314ace01933d735cf5eb2a4ea9f0b79a89df8d4cf6abe810af6de6d74c330c3b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks