Overview

overview

10

Static

static

14cef74d59...11.exe

windows7_x64

10

14cef74d59...11.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14cef74d599eae365a8881699462742f56b7a9a245bea2c255e4b5ca8a233311

  • Size

    60KB

  • Sample

    220212-fa8qqshfcr

  • MD5

    730846bc69f2f688f10854bec62e399f

  • SHA1

    2956e6bb8a149d200e9f9539ff9cf04a9f1101f3

  • SHA256

    14cef74d599eae365a8881699462742f56b7a9a245bea2c255e4b5ca8a233311

  • SHA512

    51e42df33e0ff42c7e74fca653b05a6a7a762a2faf20b147a74b7973f772f53ec3e0952cbe5a530f39bd0564bdf5761b831cbabaf6a1e0b57ca52d2ecafd0712

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14cef74d599eae365a8881699462742f56b7a9a245bea2c255e4b5ca8a233311

    • Size

      60KB

    • MD5

      730846bc69f2f688f10854bec62e399f

    • SHA1

      2956e6bb8a149d200e9f9539ff9cf04a9f1101f3

    • SHA256

      14cef74d599eae365a8881699462742f56b7a9a245bea2c255e4b5ca8a233311

    • SHA512

      51e42df33e0ff42c7e74fca653b05a6a7a762a2faf20b147a74b7973f772f53ec3e0952cbe5a530f39bd0564bdf5761b831cbabaf6a1e0b57ca52d2ecafd0712

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks