Overview

overview

10

Static

static

145f34d06f...81.exe

windows7_x64

10

145f34d06f...81.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    145f34d06f444b3f8200639bc1d7e1c9d0550837ed032bba9505fe2978e00181

  • Size

    35KB

  • Sample

    220212-fe8arsgbd9

  • MD5

    a6d4d8052b6ed802024f79ddfa017acc

  • SHA1

    588f91e974e1e90757258c8511e327ad66e6a5ce

  • SHA256

    145f34d06f444b3f8200639bc1d7e1c9d0550837ed032bba9505fe2978e00181

  • SHA512

    563b9c8bc62f9351f61eace1a0390ac5b8e7437a8ae67a63824886d3cd24a6cc940e10141d18b70a18c844f3f1361cec27b021dd0851ed3d0446bc67d2e2f678

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      145f34d06f444b3f8200639bc1d7e1c9d0550837ed032bba9505fe2978e00181

    • Size

      35KB

    • MD5

      a6d4d8052b6ed802024f79ddfa017acc

    • SHA1

      588f91e974e1e90757258c8511e327ad66e6a5ce

    • SHA256

      145f34d06f444b3f8200639bc1d7e1c9d0550837ed032bba9505fe2978e00181

    • SHA512

      563b9c8bc62f9351f61eace1a0390ac5b8e7437a8ae67a63824886d3cd24a6cc940e10141d18b70a18c844f3f1361cec27b021dd0851ed3d0446bc67d2e2f678

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks