Overview

overview

10

Static

static

10

13fd7ad9e1...7d.exe

windows7_x64

10

13fd7ad9e1...7d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13fd7ad9e1df75982bacc0f42a64d46e0c765b4a9f5fbc9f0cfd2fc97bc9d47d

  • Size

    216KB

  • Sample

    220212-fkt1bsgbh9

  • MD5

    aae796da9ad01a418d58fff0460e1fe1

  • SHA1

    0543b7feaf952fc69b5d09711e44a27aa326fb36

  • SHA256

    13fd7ad9e1df75982bacc0f42a64d46e0c765b4a9f5fbc9f0cfd2fc97bc9d47d

  • SHA512

    83d42496be9581324c76395ab4d22e4a0bac55a4ef26a3e4013b260d33de3d46bc9aefc862684f4c3972653aac805300046e119ab51c231da4e18d101dc5bec5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13fd7ad9e1df75982bacc0f42a64d46e0c765b4a9f5fbc9f0cfd2fc97bc9d47d

    • Size

      216KB

    • MD5

      aae796da9ad01a418d58fff0460e1fe1

    • SHA1

      0543b7feaf952fc69b5d09711e44a27aa326fb36

    • SHA256

      13fd7ad9e1df75982bacc0f42a64d46e0c765b4a9f5fbc9f0cfd2fc97bc9d47d

    • SHA512

      83d42496be9581324c76395ab4d22e4a0bac55a4ef26a3e4013b260d33de3d46bc9aefc862684f4c3972653aac805300046e119ab51c231da4e18d101dc5bec5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks