Overview

overview

10

Static

static

14028b2309...7f.exe

windows7_x64

10

14028b2309...7f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14028b2309ca15af5f69192d6727d1072b295bfd9941e0e8d9fd00301403747f

  • Size

    36KB

  • Sample

    220212-fkmagsgbh6

  • MD5

    f11797239498a6cebd92f964b2b42912

  • SHA1

    2f9d0702f042d97c13792f0591f405896c5c955d

  • SHA256

    14028b2309ca15af5f69192d6727d1072b295bfd9941e0e8d9fd00301403747f

  • SHA512

    690595e3f7548464c7419c6d81ab24bf36c7ef031e5fe2890e4d64b215957de2e374d5ba13ab60ab0f740c2d9be6a21240e86a780e6d5937cefd4b82309d825f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      14028b2309ca15af5f69192d6727d1072b295bfd9941e0e8d9fd00301403747f

    • Size

      36KB

    • MD5

      f11797239498a6cebd92f964b2b42912

    • SHA1

      2f9d0702f042d97c13792f0591f405896c5c955d

    • SHA256

      14028b2309ca15af5f69192d6727d1072b295bfd9941e0e8d9fd00301403747f

    • SHA512

      690595e3f7548464c7419c6d81ab24bf36c7ef031e5fe2890e4d64b215957de2e374d5ba13ab60ab0f740c2d9be6a21240e86a780e6d5937cefd4b82309d825f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks