Overview

overview

10

Static

static

10

1253b29c4c...42.exe

windows7_x64

10

1253b29c4c...42.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1253b29c4c199eab010818ba2fddf57952bfcda54d8861a56a6c429e1ebc3c42

  • Size

    192KB

  • Sample

    220212-f9rw9sabdm

  • MD5

    4113284d22657961b0a08db47ece9944

  • SHA1

    c2f0f2d20261d920a5f4e924ecb7a9d2adc9b48e

  • SHA256

    1253b29c4c199eab010818ba2fddf57952bfcda54d8861a56a6c429e1ebc3c42

  • SHA512

    403a82c184d310133520591b1a4d1df380e9688a7062470fe5ada1459d7a20e998df9879bc605bdd8f570f9a47b5644c99a7f9a3293179ef78b1591370f2c42e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1253b29c4c199eab010818ba2fddf57952bfcda54d8861a56a6c429e1ebc3c42

    • Size

      192KB

    • MD5

      4113284d22657961b0a08db47ece9944

    • SHA1

      c2f0f2d20261d920a5f4e924ecb7a9d2adc9b48e

    • SHA256

      1253b29c4c199eab010818ba2fddf57952bfcda54d8861a56a6c429e1ebc3c42

    • SHA512

      403a82c184d310133520591b1a4d1df380e9688a7062470fe5ada1459d7a20e998df9879bc605bdd8f570f9a47b5644c99a7f9a3293179ef78b1591370f2c42e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks