Overview

overview

10

Static

static

10

1291fface9...9f.exe

windows7_x64

10

1291fface9...9f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1291fface987f88a60accbad9fc1e51d54fda94c09f831748e5c327709ab7b9f

  • Size

    150KB

  • Sample

    220212-f7aj7sgec4

  • MD5

    f672c45b903ff9ed97d092a6b9ed3895

  • SHA1

    1ca25d821bd734522fe14c520b9debbaf8f66f0b

  • SHA256

    1291fface987f88a60accbad9fc1e51d54fda94c09f831748e5c327709ab7b9f

  • SHA512

    f3c5037eb3445b1ff71bafa0354c85411a2292e47e1f5f0173b505ce0469b8edcc893a41c2355e568551acb0b15e6b72383e06699346e88355169f3ec8b0df45

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1291fface987f88a60accbad9fc1e51d54fda94c09f831748e5c327709ab7b9f

    • Size

      150KB

    • MD5

      f672c45b903ff9ed97d092a6b9ed3895

    • SHA1

      1ca25d821bd734522fe14c520b9debbaf8f66f0b

    • SHA256

      1291fface987f88a60accbad9fc1e51d54fda94c09f831748e5c327709ab7b9f

    • SHA512

      f3c5037eb3445b1ff71bafa0354c85411a2292e47e1f5f0173b505ce0469b8edcc893a41c2355e568551acb0b15e6b72383e06699346e88355169f3ec8b0df45

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks