Overview

overview

10

Static

static

10

1287940357...42.exe

windows7_x64

10

1287940357...42.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1287940357da4bcf15f37ac71e6f5ea0530747e183cb9ad0a3ea806695dfd542

  • Size

    216KB

  • Sample

    220212-f7jswagec7

  • MD5

    b0e26c0f6b4f5918574a7ea6cb406af8

  • SHA1

    9b00781c9a16bb2131253818093b436dc3a9d3a7

  • SHA256

    1287940357da4bcf15f37ac71e6f5ea0530747e183cb9ad0a3ea806695dfd542

  • SHA512

    ef1c1ff8ab9c5d0321ccb37289c69e6713010894a842b88d71a17f4c7c07cd9ccf973405c549959730311f348b87625bbefdbc32d058f6c2ea2e67dcec5d8f28

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1287940357da4bcf15f37ac71e6f5ea0530747e183cb9ad0a3ea806695dfd542

    • Size

      216KB

    • MD5

      b0e26c0f6b4f5918574a7ea6cb406af8

    • SHA1

      9b00781c9a16bb2131253818093b436dc3a9d3a7

    • SHA256

      1287940357da4bcf15f37ac71e6f5ea0530747e183cb9ad0a3ea806695dfd542

    • SHA512

      ef1c1ff8ab9c5d0321ccb37289c69e6713010894a842b88d71a17f4c7c07cd9ccf973405c549959730311f348b87625bbefdbc32d058f6c2ea2e67dcec5d8f28

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks