Overview

overview

10

Static

static

10

14b81dc1e3...eb.exe

windows7_x64

10

14b81dc1e3...eb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14b81dc1e3910e74507624db0e6dc26d6b5ccd73d7eab8c9f6a79f49aa48b1eb

  • Size

    192KB

  • Sample

    220212-fcdy5sgbb2

  • MD5

    48651f91cc1bfef258d884de99f4c733

  • SHA1

    dc9162969810ac60749f6561df772a20d16bb9be

  • SHA256

    14b81dc1e3910e74507624db0e6dc26d6b5ccd73d7eab8c9f6a79f49aa48b1eb

  • SHA512

    7acfc642722a056c516a17014af2fc40a47b3cf32bbfad5bb0966d9663bfb0533de8edbdbbe8fb900b6e6b7c7e1591217ce51636c489989f835a26d18759cdab

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14b81dc1e3910e74507624db0e6dc26d6b5ccd73d7eab8c9f6a79f49aa48b1eb

    • Size

      192KB

    • MD5

      48651f91cc1bfef258d884de99f4c733

    • SHA1

      dc9162969810ac60749f6561df772a20d16bb9be

    • SHA256

      14b81dc1e3910e74507624db0e6dc26d6b5ccd73d7eab8c9f6a79f49aa48b1eb

    • SHA512

      7acfc642722a056c516a17014af2fc40a47b3cf32bbfad5bb0966d9663bfb0533de8edbdbbe8fb900b6e6b7c7e1591217ce51636c489989f835a26d18759cdab

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks