Overview

overview

10

Static

static

10

128e76c246...7f.exe

windows7_x64

10

128e76c246...7f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    128e76c246ca375a451b75a087d5f9686136ea660d58bc5c9d23a13b3d92807f

  • Size

    192KB

  • Sample

    220212-f7etxsabar

  • MD5

    b615d19df3bc6d4b6e286472f6c8dd05

  • SHA1

    9b6a64024ed7de64c314d2a7bb587946f5fa357e

  • SHA256

    128e76c246ca375a451b75a087d5f9686136ea660d58bc5c9d23a13b3d92807f

  • SHA512

    26f1cf3587e382802d479902d4328db29cba84d384a8d1c5b11c6e35ab7c89ca7d44c95a6adcf1b9694a4bcb1e7bd6e8fc175c8abf982b65172cba9499ef3c1c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      128e76c246ca375a451b75a087d5f9686136ea660d58bc5c9d23a13b3d92807f

    • Size

      192KB

    • MD5

      b615d19df3bc6d4b6e286472f6c8dd05

    • SHA1

      9b6a64024ed7de64c314d2a7bb587946f5fa357e

    • SHA256

      128e76c246ca375a451b75a087d5f9686136ea660d58bc5c9d23a13b3d92807f

    • SHA512

      26f1cf3587e382802d479902d4328db29cba84d384a8d1c5b11c6e35ab7c89ca7d44c95a6adcf1b9694a4bcb1e7bd6e8fc175c8abf982b65172cba9499ef3c1c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks