Overview

overview

10

Static

static

10

127de61827...e4.exe

windows7_x64

10

127de61827...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    127de618276f0ef30de0520afcfc8c1fba25d02cb54b1e996dcddd1f996d57e4

  • Size

    192KB

  • Sample

    220212-f7s2jsgec8

  • MD5

    8e1c5f5035cdca733ea2f1cf5d23292b

  • SHA1

    ddc71a9ac59957d28f1526b3741f23c9cbd60f82

  • SHA256

    127de618276f0ef30de0520afcfc8c1fba25d02cb54b1e996dcddd1f996d57e4

  • SHA512

    eb472ea2652048b2d6046c44b8b7f1c24e53ef4b7f18b1d075233532d27cad652b7b07f72e565a9ddf591447e5286f2106e1ff2d4fdf8baffb312b5f89ddc472

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      127de618276f0ef30de0520afcfc8c1fba25d02cb54b1e996dcddd1f996d57e4

    • Size

      192KB

    • MD5

      8e1c5f5035cdca733ea2f1cf5d23292b

    • SHA1

      ddc71a9ac59957d28f1526b3741f23c9cbd60f82

    • SHA256

      127de618276f0ef30de0520afcfc8c1fba25d02cb54b1e996dcddd1f996d57e4

    • SHA512

      eb472ea2652048b2d6046c44b8b7f1c24e53ef4b7f18b1d075233532d27cad652b7b07f72e565a9ddf591447e5286f2106e1ff2d4fdf8baffb312b5f89ddc472

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks