Overview

overview

10

Static

static

10

13ddcb0c0e...65.exe

windows7_x64

10

13ddcb0c0e...65.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65

  • Size

    99KB

  • Sample

    220212-fm7dfagcb7

  • MD5

    c75a4ef10b5ddee0be5114f65cb17ad7

  • SHA1

    805463c17a9cb639f9f68ad0ea3acf1f7b02c037

  • SHA256

    13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65

  • SHA512

    f6732610bbf6bc5c227954db21d64e8c591413b448eebffc1fb52285915c1a5ab0fa1d333143d5feae4a1221221b0f6b0a49fc5ae8f6e8770ef981453d813f0a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65

    • Size

      99KB

    • MD5

      c75a4ef10b5ddee0be5114f65cb17ad7

    • SHA1

      805463c17a9cb639f9f68ad0ea3acf1f7b02c037

    • SHA256

      13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65

    • SHA512

      f6732610bbf6bc5c227954db21d64e8c591413b448eebffc1fb52285915c1a5ab0fa1d333143d5feae4a1221221b0f6b0a49fc5ae8f6e8770ef981453d813f0a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks