Overview

overview

10

Static

static

10

1420ffe660...6f.exe

windows7_x64

10

1420ffe660...6f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1420ffe660cb72e71cdfc92c0570c6db6b74bf0137caf4bb4b93ddb34e1e1d6f

  • Size

    79KB

  • Sample

    220212-fjakasgbg7

  • MD5

    8056c09a25a453922d7e0204dd3d89b1

  • SHA1

    bf47a842be9b4cbca8373601d2ba41e6242f33bc

  • SHA256

    1420ffe660cb72e71cdfc92c0570c6db6b74bf0137caf4bb4b93ddb34e1e1d6f

  • SHA512

    93bfdf6ec53757194004e6862d0684cf98175b3779512350d6caa29ffad02c38e6008d3280b8632cb8c1e940af4857dc09642fdceb3087848c4f0088dae19df2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1420ffe660cb72e71cdfc92c0570c6db6b74bf0137caf4bb4b93ddb34e1e1d6f

    • Size

      79KB

    • MD5

      8056c09a25a453922d7e0204dd3d89b1

    • SHA1

      bf47a842be9b4cbca8373601d2ba41e6242f33bc

    • SHA256

      1420ffe660cb72e71cdfc92c0570c6db6b74bf0137caf4bb4b93ddb34e1e1d6f

    • SHA512

      93bfdf6ec53757194004e6862d0684cf98175b3779512350d6caa29ffad02c38e6008d3280b8632cb8c1e940af4857dc09642fdceb3087848c4f0088dae19df2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks