Overview

overview

10

Static

static

125a47c3f6...a5.exe

windows7_x64

10

125a47c3f6...a5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    125a47c3f63aa86810cce2dbb67669660a71f98f0b8f0d959f695a27188158a5

  • Size

    58KB

  • Sample

    220212-f9mmjsgee5

  • MD5

    d88045845e647776e8fef388be32dbc4

  • SHA1

    3a4aa6fd1263362639a71f5f3852a7ef32ef4380

  • SHA256

    125a47c3f63aa86810cce2dbb67669660a71f98f0b8f0d959f695a27188158a5

  • SHA512

    8da6e4fdb9fe540324660c2abeb2ec388b430a72ffe053f15db035dd36161b6a6ad06a4100e61e37d62f230a1f2b4aa950616b8826b9d6a33c147894fffa111c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      125a47c3f63aa86810cce2dbb67669660a71f98f0b8f0d959f695a27188158a5

    • Size

      58KB

    • MD5

      d88045845e647776e8fef388be32dbc4

    • SHA1

      3a4aa6fd1263362639a71f5f3852a7ef32ef4380

    • SHA256

      125a47c3f63aa86810cce2dbb67669660a71f98f0b8f0d959f695a27188158a5

    • SHA512

      8da6e4fdb9fe540324660c2abeb2ec388b430a72ffe053f15db035dd36161b6a6ad06a4100e61e37d62f230a1f2b4aa950616b8826b9d6a33c147894fffa111c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks