Overview

overview

10

Static

static

10

14080340fd...a4.exe

windows7_x64

10

14080340fd...a4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14080340fddb074f2203fbd299f63bb494aba08ca4287fab5c91d234ef8164a4

  • Size

    101KB

  • Sample

    220212-fj83vsgbh3

  • MD5

    e08ca13cfdcd44465d40912daac259e0

  • SHA1

    903368c529369566b4acdaaf39591f058c5ab8f9

  • SHA256

    14080340fddb074f2203fbd299f63bb494aba08ca4287fab5c91d234ef8164a4

  • SHA512

    5d6cbb9a2433a3e0d4dbc85805d3ca0e5111b9bf7c3eb7ce9cab926ef8d95bb777e22496c59b0b9004d77c1ac699d8cca07403889233a923d3af4ce6418024da

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14080340fddb074f2203fbd299f63bb494aba08ca4287fab5c91d234ef8164a4

    • Size

      101KB

    • MD5

      e08ca13cfdcd44465d40912daac259e0

    • SHA1

      903368c529369566b4acdaaf39591f058c5ab8f9

    • SHA256

      14080340fddb074f2203fbd299f63bb494aba08ca4287fab5c91d234ef8164a4

    • SHA512

      5d6cbb9a2433a3e0d4dbc85805d3ca0e5111b9bf7c3eb7ce9cab926ef8d95bb777e22496c59b0b9004d77c1ac699d8cca07403889233a923d3af4ce6418024da

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks