Overview

overview

10

Static

static

10

148c5daeb5...8a.exe

windows7_x64

10

148c5daeb5...8a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a

  • Size

    99KB

  • Sample

    220212-fdy1pshffp

  • MD5

    d7763de0e4870aa1374f4ae21216f0ad

  • SHA1

    c27bd5092f81863588b240d5be9ea768c18d8b27

  • SHA256

    148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a

  • SHA512

    99cb587db7edbf28b0ab2a641df64961e84cdf8310a4f2ce0a5184af9c1d54942d252344671be55ef4f6ca86b72e6d8d66e5e967e8457fd83870b7c3954ec539

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a

    • Size

      99KB

    • MD5

      d7763de0e4870aa1374f4ae21216f0ad

    • SHA1

      c27bd5092f81863588b240d5be9ea768c18d8b27

    • SHA256

      148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a

    • SHA512

      99cb587db7edbf28b0ab2a641df64961e84cdf8310a4f2ce0a5184af9c1d54942d252344671be55ef4f6ca86b72e6d8d66e5e967e8457fd83870b7c3954ec539

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks