Overview

overview

10

Static

static

10

1430a033f2...fe.exe

windows7_x64

10

1430a033f2...fe.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1430a033f281f61b3ad9ed7c7cc86abd8e5155a88343b0465d9f6901509ac6fe

  • Size

    99KB

  • Sample

    220212-fhe4dsgbg2

  • MD5

    03ea6c736eda5052f3a8f7881175d9bb

  • SHA1

    00f13b2ddcfae3e316852e507e44533fcdd6efb4

  • SHA256

    1430a033f281f61b3ad9ed7c7cc86abd8e5155a88343b0465d9f6901509ac6fe

  • SHA512

    598ef1c6a3cc1991d0d91ebafd455cbbc51a4917a975aa7c047fd40298768ed0f582f17abb99adf36864ff395dd1071826fe147280c26ef1becb886ac0b07473

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1430a033f281f61b3ad9ed7c7cc86abd8e5155a88343b0465d9f6901509ac6fe

    • Size

      99KB

    • MD5

      03ea6c736eda5052f3a8f7881175d9bb

    • SHA1

      00f13b2ddcfae3e316852e507e44533fcdd6efb4

    • SHA256

      1430a033f281f61b3ad9ed7c7cc86abd8e5155a88343b0465d9f6901509ac6fe

    • SHA512

      598ef1c6a3cc1991d0d91ebafd455cbbc51a4917a975aa7c047fd40298768ed0f582f17abb99adf36864ff395dd1071826fe147280c26ef1becb886ac0b07473

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks