Overview

overview

10

Static

static

12b1cb5a5a...89.exe

windows7_x64

10

12b1cb5a5a...89.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12b1cb5a5ab6d4caa3b5103589338e7dc0b99cf2685afab56ac2d056f829ef89

  • Size

    60KB

  • Sample

    220212-f5gkqsaahk

  • MD5

    f6192b64a55b89fd26a462bcba3223d9

  • SHA1

    742bd5daac69fc6ac52c829a0d189dd46888ecaa

  • SHA256

    12b1cb5a5ab6d4caa3b5103589338e7dc0b99cf2685afab56ac2d056f829ef89

  • SHA512

    942c645eec70f7fd07e852309d6b9fe9426ac104f46d6a83e32a08e9befa76ba2f8fbd4c10550144e20239407eec566ed98da2a13109fce81067f20dd8b5ff18

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12b1cb5a5ab6d4caa3b5103589338e7dc0b99cf2685afab56ac2d056f829ef89

    • Size

      60KB

    • MD5

      f6192b64a55b89fd26a462bcba3223d9

    • SHA1

      742bd5daac69fc6ac52c829a0d189dd46888ecaa

    • SHA256

      12b1cb5a5ab6d4caa3b5103589338e7dc0b99cf2685afab56ac2d056f829ef89

    • SHA512

      942c645eec70f7fd07e852309d6b9fe9426ac104f46d6a83e32a08e9befa76ba2f8fbd4c10550144e20239407eec566ed98da2a13109fce81067f20dd8b5ff18

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks