Overview

overview

10

Static

static

12605b3378...d6.exe

windows7_x64

10

12605b3378...d6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12605b3378beea68e93629d41eb06acef4237d676182ff1d36437ef642685fd6

  • Size

    60KB

  • Sample

    220212-f84vfaged8

  • MD5

    b00c4518377eb26cc2e4d759447c7335

  • SHA1

    17b1e7d99cd86e4f74c802f5a08250a745d61f70

  • SHA256

    12605b3378beea68e93629d41eb06acef4237d676182ff1d36437ef642685fd6

  • SHA512

    0a793c4c4add7c486c4efe96556b14ad1ce3b45662568d3f1e98672d9b6a470bedf813eb4560f97b53ebc0a8808a0e35a74fe139e29db92a67ce311babbd96d0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12605b3378beea68e93629d41eb06acef4237d676182ff1d36437ef642685fd6

    • Size

      60KB

    • MD5

      b00c4518377eb26cc2e4d759447c7335

    • SHA1

      17b1e7d99cd86e4f74c802f5a08250a745d61f70

    • SHA256

      12605b3378beea68e93629d41eb06acef4237d676182ff1d36437ef642685fd6

    • SHA512

      0a793c4c4add7c486c4efe96556b14ad1ce3b45662568d3f1e98672d9b6a470bedf813eb4560f97b53ebc0a8808a0e35a74fe139e29db92a67ce311babbd96d0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks