Overview

overview

10

Static

static

10

14c55e4f0e...27.exe

windows7_x64

10

14c55e4f0e...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14c55e4f0ee30912cfafb70aacb574ef33a5c0f5b58df8dae20b84a408fe4227

  • Size

    80KB

  • Sample

    220212-fbqxbahfdp

  • MD5

    bfc0247ec59849ae2298997f9fc2a220

  • SHA1

    4c9191907ddd1179a7859da419bce0974463803a

  • SHA256

    14c55e4f0ee30912cfafb70aacb574ef33a5c0f5b58df8dae20b84a408fe4227

  • SHA512

    1e790580eb7a22593bb25ccb79133d0b4a71edbdd3d288fedef83126cc95d823d6180f9e5a39ccaff0edee53e29996b23a6b3c6f9fb4943fdeea11e39c5ba857

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14c55e4f0ee30912cfafb70aacb574ef33a5c0f5b58df8dae20b84a408fe4227

    • Size

      80KB

    • MD5

      bfc0247ec59849ae2298997f9fc2a220

    • SHA1

      4c9191907ddd1179a7859da419bce0974463803a

    • SHA256

      14c55e4f0ee30912cfafb70aacb574ef33a5c0f5b58df8dae20b84a408fe4227

    • SHA512

      1e790580eb7a22593bb25ccb79133d0b4a71edbdd3d288fedef83126cc95d823d6180f9e5a39ccaff0edee53e29996b23a6b3c6f9fb4943fdeea11e39c5ba857

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks