Overview

overview

10

Static

static

1407296f4b...42.exe

windows7_x64

10

1407296f4b...42.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1407296f4bd52987bcb16ade2451179a5f0df8047722e4f028ec0d73a5ad3742

  • Size

    36KB

  • Sample

    220212-fkc2tahgel

  • MD5

    db8b536b6213eebf014a4bd01991a1fe

  • SHA1

    fda832c1aba8a30ad6af755a8079171f6c92fc01

  • SHA256

    1407296f4bd52987bcb16ade2451179a5f0df8047722e4f028ec0d73a5ad3742

  • SHA512

    df4f49ae8cb2fe04f82fb0a6598e39724a3c9b97ad2613f8053587d92b64b648190bb435f409c2ac9a18cb164041f0fd651c25f283eec45036204f7d1dce0049

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1407296f4bd52987bcb16ade2451179a5f0df8047722e4f028ec0d73a5ad3742

    • Size

      36KB

    • MD5

      db8b536b6213eebf014a4bd01991a1fe

    • SHA1

      fda832c1aba8a30ad6af755a8079171f6c92fc01

    • SHA256

      1407296f4bd52987bcb16ade2451179a5f0df8047722e4f028ec0d73a5ad3742

    • SHA512

      df4f49ae8cb2fe04f82fb0a6598e39724a3c9b97ad2613f8053587d92b64b648190bb435f409c2ac9a18cb164041f0fd651c25f283eec45036204f7d1dce0049

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks