Overview

overview

10

Static

static

10

14e00851da...3a.exe

windows7_x64

10

14e00851da...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14e00851da0fd8ea25ccb064acc7a6a2b27b1c9a0206a2b89a006d2f34085a3a

  • Size

    168KB

  • Sample

    220212-fae4esgah4

  • MD5

    cce4e7ebab94c2ced267a34dfd187525

  • SHA1

    2f68f04e7bd67c99ae4ffd039804af999d11f3d7

  • SHA256

    14e00851da0fd8ea25ccb064acc7a6a2b27b1c9a0206a2b89a006d2f34085a3a

  • SHA512

    377f388dce5d62cc911f01e7ea19e937653f1bacea0a2e05375a7ee3ab262b702fd6c67253958000590b57a41911299e5c26bf2c573bc75cb038a685be36e009

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14e00851da0fd8ea25ccb064acc7a6a2b27b1c9a0206a2b89a006d2f34085a3a

    • Size

      168KB

    • MD5

      cce4e7ebab94c2ced267a34dfd187525

    • SHA1

      2f68f04e7bd67c99ae4ffd039804af999d11f3d7

    • SHA256

      14e00851da0fd8ea25ccb064acc7a6a2b27b1c9a0206a2b89a006d2f34085a3a

    • SHA512

      377f388dce5d62cc911f01e7ea19e937653f1bacea0a2e05375a7ee3ab262b702fd6c67253958000590b57a41911299e5c26bf2c573bc75cb038a685be36e009

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks