Overview

overview

10

Static

static

10

1493451949...ed.exe

windows7_x64

10

1493451949...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1493451949668338017ceeb3cc2bcf4c6d1eb93bff8bda2da7b29b697d20beed

  • Size

    99KB

  • Sample

    220212-fdrxdsgbc7

  • MD5

    71bd659878cab28f02cfe6033a6047e7

  • SHA1

    6f8b5f475bd20ed793c470c476f8ef76153a87a5

  • SHA256

    1493451949668338017ceeb3cc2bcf4c6d1eb93bff8bda2da7b29b697d20beed

  • SHA512

    01e422fd979b899d8d7d69224652e61d73e0826e5cbf741c81489a5baad4415633d5ce4951dffeab3814330214dcfc8d0408d361d875913c09f3ca8e35259f70

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1493451949668338017ceeb3cc2bcf4c6d1eb93bff8bda2da7b29b697d20beed

    • Size

      99KB

    • MD5

      71bd659878cab28f02cfe6033a6047e7

    • SHA1

      6f8b5f475bd20ed793c470c476f8ef76153a87a5

    • SHA256

      1493451949668338017ceeb3cc2bcf4c6d1eb93bff8bda2da7b29b697d20beed

    • SHA512

      01e422fd979b899d8d7d69224652e61d73e0826e5cbf741c81489a5baad4415633d5ce4951dffeab3814330214dcfc8d0408d361d875913c09f3ca8e35259f70

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks