Overview

overview

10

Static

static

10

1409c72025...52.exe

windows7_x64

10

1409c72025...52.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1409c7202531a29a64ea6b31360e9f29e807c1d5381f257b33310e045695c352

  • Size

    80KB

  • Sample

    220212-fj44xahgdq

  • MD5

    a2e6dc688612eb075828acf9e62e0903

  • SHA1

    973e4216bb68ffd8610076ba8e6bc17be586a2b9

  • SHA256

    1409c7202531a29a64ea6b31360e9f29e807c1d5381f257b33310e045695c352

  • SHA512

    84675b2ff48cbc16e14af6a1009b2913fef08a525f3cc74c80803e94d809be2b4d4126a7090d0b00b3711649f76d6f40363fea9c6b2ee6df7358d5744f015a26

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1409c7202531a29a64ea6b31360e9f29e807c1d5381f257b33310e045695c352

    • Size

      80KB

    • MD5

      a2e6dc688612eb075828acf9e62e0903

    • SHA1

      973e4216bb68ffd8610076ba8e6bc17be586a2b9

    • SHA256

      1409c7202531a29a64ea6b31360e9f29e807c1d5381f257b33310e045695c352

    • SHA512

      84675b2ff48cbc16e14af6a1009b2913fef08a525f3cc74c80803e94d809be2b4d4126a7090d0b00b3711649f76d6f40363fea9c6b2ee6df7358d5744f015a26

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks