Overview

overview

10

Static

static

129a2e1450...a2.exe

windows7_x64

10

129a2e1450...a2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    129a2e1450730366299afa9738d813c63f3ba60f21b8966616a07967a5c905a2

  • Size

    58KB

  • Sample

    220212-f6y66sgeb9

  • MD5

    62f9fcd389f2a8071c985b9fa14b536c

  • SHA1

    eb4f9df6ef441274c6a765a2b30c45c715170b0b

  • SHA256

    129a2e1450730366299afa9738d813c63f3ba60f21b8966616a07967a5c905a2

  • SHA512

    5a92435f1ef8521352d400cda4fe672a2388fa7db55cfe3e4be76dca8e621daedbb5b1458311601d1459c24038c1738faaf7c15c6a6d2fa83d0c81dfb748c7e5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      129a2e1450730366299afa9738d813c63f3ba60f21b8966616a07967a5c905a2

    • Size

      58KB

    • MD5

      62f9fcd389f2a8071c985b9fa14b536c

    • SHA1

      eb4f9df6ef441274c6a765a2b30c45c715170b0b

    • SHA256

      129a2e1450730366299afa9738d813c63f3ba60f21b8966616a07967a5c905a2

    • SHA512

      5a92435f1ef8521352d400cda4fe672a2388fa7db55cfe3e4be76dca8e621daedbb5b1458311601d1459c24038c1738faaf7c15c6a6d2fa83d0c81dfb748c7e5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks