Overview

overview

10

Static

static

14d1d6a9e1...f9.exe

windows7_x64

10

14d1d6a9e1...f9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14d1d6a9e13497be8abae3b9f31971794b5eb4a788f73e3568e16e119a2033f9

  • Size

    60KB

  • Sample

    220212-faw2yagah6

  • MD5

    2aeff98e885f9a0c40b3b9815cfac6ab

  • SHA1

    32e2ff29afd92dc7bab2f1d1316a6a6fb5705d63

  • SHA256

    14d1d6a9e13497be8abae3b9f31971794b5eb4a788f73e3568e16e119a2033f9

  • SHA512

    83496a254ff0f164488708c30af4769dca6373ab0443ca4d7642dfffdba04ac84a38eb1a86a198262db773ed28f7b9bcdb894cb5dfbac62806910416b62b007d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14d1d6a9e13497be8abae3b9f31971794b5eb4a788f73e3568e16e119a2033f9

    • Size

      60KB

    • MD5

      2aeff98e885f9a0c40b3b9815cfac6ab

    • SHA1

      32e2ff29afd92dc7bab2f1d1316a6a6fb5705d63

    • SHA256

      14d1d6a9e13497be8abae3b9f31971794b5eb4a788f73e3568e16e119a2033f9

    • SHA512

      83496a254ff0f164488708c30af4769dca6373ab0443ca4d7642dfffdba04ac84a38eb1a86a198262db773ed28f7b9bcdb894cb5dfbac62806910416b62b007d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks