Overview

overview

10

Static

static

10

146ab306fe...05.exe

windows7_x64

10

146ab306fe...05.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    146ab306fe577504861a515a8b0dee70bb12b82015d6fddac0baf94afc042605

  • Size

    99KB

  • Sample

    220212-feyfkagbd7

  • MD5

    6d4cf0aa2053d5538b29e38474c68a9c

  • SHA1

    ffe0ef039f8a4f6d2d05a1ccaf27add1aba86264

  • SHA256

    146ab306fe577504861a515a8b0dee70bb12b82015d6fddac0baf94afc042605

  • SHA512

    0de0c515110c8e13f4650af6500be606ecdfe20577f6c4fef9422e40658c7e6fbea2a9baea5d3ac1b6ba8c0e9f0e3011bc0dec91bb349314420fd5d9995bf82e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      146ab306fe577504861a515a8b0dee70bb12b82015d6fddac0baf94afc042605

    • Size

      99KB

    • MD5

      6d4cf0aa2053d5538b29e38474c68a9c

    • SHA1

      ffe0ef039f8a4f6d2d05a1ccaf27add1aba86264

    • SHA256

      146ab306fe577504861a515a8b0dee70bb12b82015d6fddac0baf94afc042605

    • SHA512

      0de0c515110c8e13f4650af6500be606ecdfe20577f6c4fef9422e40658c7e6fbea2a9baea5d3ac1b6ba8c0e9f0e3011bc0dec91bb349314420fd5d9995bf82e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks