Overview

overview

10

Static

static

143f260f05...90.exe

windows7_x64

10

143f260f05...90.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    143f260f05a8c8f46651aeac462e3ec3e86a8fd3867aebc945d749a4f7f05690

  • Size

    36KB

  • Sample

    220212-fgvgpagbf4

  • MD5

    5ec5ffa8c5e7fa14b37de6f944c7c7f1

  • SHA1

    5c82d4cc0623bfb9e67fa2c702eea30111f8f45b

  • SHA256

    143f260f05a8c8f46651aeac462e3ec3e86a8fd3867aebc945d749a4f7f05690

  • SHA512

    161a56dcfb0d3146d19c64f1dca1e02251983055822a28ee8e5183bbd94e4f26b244385ba6db0bad5f7ae8e35671a9a55a798006efdfa83c9af8fc071e230a8c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      143f260f05a8c8f46651aeac462e3ec3e86a8fd3867aebc945d749a4f7f05690

    • Size

      36KB

    • MD5

      5ec5ffa8c5e7fa14b37de6f944c7c7f1

    • SHA1

      5c82d4cc0623bfb9e67fa2c702eea30111f8f45b

    • SHA256

      143f260f05a8c8f46651aeac462e3ec3e86a8fd3867aebc945d749a4f7f05690

    • SHA512

      161a56dcfb0d3146d19c64f1dca1e02251983055822a28ee8e5183bbd94e4f26b244385ba6db0bad5f7ae8e35671a9a55a798006efdfa83c9af8fc071e230a8c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks