Overview

overview

10

Static

static

13f0ada424...2c.exe

windows7_x64

10

13f0ada424...2c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13f0ada424c2518e27c61d6d7d70e20b62f7b93046176805cfc88d00f6698c2c

  • Size

    35KB

  • Sample

    220212-fly1nshggj

  • MD5

    23c5f8497a1c307c4ccf6bf81434a186

  • SHA1

    0a4f212518619a97e95c28360fe1f6a18ead69f1

  • SHA256

    13f0ada424c2518e27c61d6d7d70e20b62f7b93046176805cfc88d00f6698c2c

  • SHA512

    3a997eb770f357874993fac9b4dceb1095a50d5c3f1d0fa50bdbcb42cd433f2574defc0e6a00877df938e4b5f637bdd8d57b71b14175a9840475b9d50500934c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13f0ada424c2518e27c61d6d7d70e20b62f7b93046176805cfc88d00f6698c2c

    • Size

      35KB

    • MD5

      23c5f8497a1c307c4ccf6bf81434a186

    • SHA1

      0a4f212518619a97e95c28360fe1f6a18ead69f1

    • SHA256

      13f0ada424c2518e27c61d6d7d70e20b62f7b93046176805cfc88d00f6698c2c

    • SHA512

      3a997eb770f357874993fac9b4dceb1095a50d5c3f1d0fa50bdbcb42cd433f2574defc0e6a00877df938e4b5f637bdd8d57b71b14175a9840475b9d50500934c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks