Overview

overview

10

Static

static

13f73870c7...b1.exe

windows7_x64

10

13f73870c7...b1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13f73870c7c3bbb9595514aa5c3cbe0252713661cdcf8c8959004c2564ea92b1

  • Size

    36KB

  • Sample

    220212-flrxcshgfq

  • MD5

    19f3356171e920c68795117fba4c1909

  • SHA1

    8b9ad44bc30158d008bed92e28c1efd854b2d9c0

  • SHA256

    13f73870c7c3bbb9595514aa5c3cbe0252713661cdcf8c8959004c2564ea92b1

  • SHA512

    2fd3e0ce3f3beee073a655bb984868667414dbb3a0bd6b3310a4c306d7754c026f395791be68177d9ec537e2c871f4a7d12df17b8fb20aa190d232a4f49cae8f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13f73870c7c3bbb9595514aa5c3cbe0252713661cdcf8c8959004c2564ea92b1

    • Size

      36KB

    • MD5

      19f3356171e920c68795117fba4c1909

    • SHA1

      8b9ad44bc30158d008bed92e28c1efd854b2d9c0

    • SHA256

      13f73870c7c3bbb9595514aa5c3cbe0252713661cdcf8c8959004c2564ea92b1

    • SHA512

      2fd3e0ce3f3beee073a655bb984868667414dbb3a0bd6b3310a4c306d7754c026f395791be68177d9ec537e2c871f4a7d12df17b8fb20aa190d232a4f49cae8f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks