Overview

overview

10

Static

static

10

147b3ab1f7...29.exe

windows7_x64

10

147b3ab1f7...29.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    147b3ab1f78e903ee4629ea8d29cea3e067b1998f48a39400eed03bdf0279029

  • Size

    100KB

  • Sample

    220212-feb8bshfgk

  • MD5

    75c5f8ee7d85854b1740acd661033d39

  • SHA1

    94215ed78ec698a1b72ff4bb18959c12472ca5cf

  • SHA256

    147b3ab1f78e903ee4629ea8d29cea3e067b1998f48a39400eed03bdf0279029

  • SHA512

    75d3486ec3cbb03e61a4c1aa4935058242aea8752f275e89ee757d9e1a7207885c14a1713b2c3167a184a4d0a5d50f232407c4373b7f09020fc086951937d4ae

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      147b3ab1f78e903ee4629ea8d29cea3e067b1998f48a39400eed03bdf0279029

    • Size

      100KB

    • MD5

      75c5f8ee7d85854b1740acd661033d39

    • SHA1

      94215ed78ec698a1b72ff4bb18959c12472ca5cf

    • SHA256

      147b3ab1f78e903ee4629ea8d29cea3e067b1998f48a39400eed03bdf0279029

    • SHA512

      75d3486ec3cbb03e61a4c1aa4935058242aea8752f275e89ee757d9e1a7207885c14a1713b2c3167a184a4d0a5d50f232407c4373b7f09020fc086951937d4ae

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks