Overview

overview

10

Static

static

10

14c2d6fbed...9b.exe

windows7_x64

10

14c2d6fbed...9b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14c2d6fbed8e34eef0dcac2ebd3bcec8be8ed887e03e6f99e6f9982915e3879b

  • Size

    89KB

  • Sample

    220212-fbwgssgba6

  • MD5

    0f97508957cc5f0397e25c39657145ee

  • SHA1

    90fde6621f25c5915adadfe888a8d061b33e7367

  • SHA256

    14c2d6fbed8e34eef0dcac2ebd3bcec8be8ed887e03e6f99e6f9982915e3879b

  • SHA512

    ffdd5141f6347b40f3c5628c37b635a46ad2144ecb51e829ce1ba196a8ddfd73ab615270d5017780b3dad92748e9adf9f1b0c788dc3760ec0d24f94c23caf82c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14c2d6fbed8e34eef0dcac2ebd3bcec8be8ed887e03e6f99e6f9982915e3879b

    • Size

      89KB

    • MD5

      0f97508957cc5f0397e25c39657145ee

    • SHA1

      90fde6621f25c5915adadfe888a8d061b33e7367

    • SHA256

      14c2d6fbed8e34eef0dcac2ebd3bcec8be8ed887e03e6f99e6f9982915e3879b

    • SHA512

      ffdd5141f6347b40f3c5628c37b635a46ad2144ecb51e829ce1ba196a8ddfd73ab615270d5017780b3dad92748e9adf9f1b0c788dc3760ec0d24f94c23caf82c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks