Overview

overview

10

Static

static

10

1281d7f5c5...f3.exe

windows7_x64

10

1281d7f5c5...f3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1281d7f5c56a4bdb974f6151972603afd55d07ecb3fc5306cc3945158f4936f3

  • Size

    80KB

  • Sample

    220212-f7n3laabbk

  • MD5

    4b4c129f9cce90f19f303b5d0c52452b

  • SHA1

    60925ab268d4cef64806cc1962258b524b448a46

  • SHA256

    1281d7f5c56a4bdb974f6151972603afd55d07ecb3fc5306cc3945158f4936f3

  • SHA512

    366e24f43037d1607a04b0cd6e87f6aa587e2457980569f58d4ef6e77e3aebf4b3a93b493d5b4a3b8e886b6a262b6ae972d49057f3910e9b29a4f91a1a283517

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1281d7f5c56a4bdb974f6151972603afd55d07ecb3fc5306cc3945158f4936f3

    • Size

      80KB

    • MD5

      4b4c129f9cce90f19f303b5d0c52452b

    • SHA1

      60925ab268d4cef64806cc1962258b524b448a46

    • SHA256

      1281d7f5c56a4bdb974f6151972603afd55d07ecb3fc5306cc3945158f4936f3

    • SHA512

      366e24f43037d1607a04b0cd6e87f6aa587e2457980569f58d4ef6e77e3aebf4b3a93b493d5b4a3b8e886b6a262b6ae972d49057f3910e9b29a4f91a1a283517

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks