Overview

overview

10

Static

static

1445dd410b...3f.exe

windows7_x64

10

1445dd410b...3f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1445dd410bb1eb9cb78c3a48db7a35f63c7aea2a3362e2c0e863cc78eed4b13f

  • Size

    35KB

  • Sample

    220212-fgljsahgaq

  • MD5

    bf5cc2eededf22c913f500b744b51bcd

  • SHA1

    5bc6be9aa45ab842edd274f67847814292eda450

  • SHA256

    1445dd410bb1eb9cb78c3a48db7a35f63c7aea2a3362e2c0e863cc78eed4b13f

  • SHA512

    01bdfda49e8181f9513ef083525dfcda239dba7d3960f3aeb8650f258f82169c1146ee1e14f0175a8771f7faef4445a2f2470b82533c8340ccc1df1176f71be3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1445dd410bb1eb9cb78c3a48db7a35f63c7aea2a3362e2c0e863cc78eed4b13f

    • Size

      35KB

    • MD5

      bf5cc2eededf22c913f500b744b51bcd

    • SHA1

      5bc6be9aa45ab842edd274f67847814292eda450

    • SHA256

      1445dd410bb1eb9cb78c3a48db7a35f63c7aea2a3362e2c0e863cc78eed4b13f

    • SHA512

      01bdfda49e8181f9513ef083525dfcda239dba7d3960f3aeb8650f258f82169c1146ee1e14f0175a8771f7faef4445a2f2470b82533c8340ccc1df1176f71be3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks