Overview

overview

10

Static

static

10

14b1bdfad0...25.exe

windows7_x64

10

14b1bdfad0...25.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14b1bdfad0c474a6b712dde20236f4e4a5c9d68a4cee46d51ed107017acf5925

  • Size

    99KB

  • Sample

    220212-fch8vsgbb3

  • MD5

    861efbe57e0c74977e0104edb9184dec

  • SHA1

    f070aa10af8dcee7b0d00ebec0fde45a65810cad

  • SHA256

    14b1bdfad0c474a6b712dde20236f4e4a5c9d68a4cee46d51ed107017acf5925

  • SHA512

    46906fe2584c6572596660b1ae0be211a8935ccb72fcec68163ce6b0dabaeb759af5d12a0cf889f2afe1da7827f6cb1dddb48877ac8196c2f3349af30de512a7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14b1bdfad0c474a6b712dde20236f4e4a5c9d68a4cee46d51ed107017acf5925

    • Size

      99KB

    • MD5

      861efbe57e0c74977e0104edb9184dec

    • SHA1

      f070aa10af8dcee7b0d00ebec0fde45a65810cad

    • SHA256

      14b1bdfad0c474a6b712dde20236f4e4a5c9d68a4cee46d51ed107017acf5925

    • SHA512

      46906fe2584c6572596660b1ae0be211a8935ccb72fcec68163ce6b0dabaeb759af5d12a0cf889f2afe1da7827f6cb1dddb48877ac8196c2f3349af30de512a7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks