Overview

overview

10

Static

static

13e6e9eae0...83.exe

windows7_x64

10

13e6e9eae0...83.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13e6e9eae0d947cb5bb0e13f63ef8b83e6d0ade03cdccdef052e9e20bc755e83

  • Size

    58KB

  • Sample

    220212-fmxt1agcb5

  • MD5

    8ce91eabb4065db7bed9fb6ebd336ea4

  • SHA1

    e9287ba26fd5b446d9bca8166b2e7b6e7b230444

  • SHA256

    13e6e9eae0d947cb5bb0e13f63ef8b83e6d0ade03cdccdef052e9e20bc755e83

  • SHA512

    8c1b5fbf60c66e6f24585cc806ce0c8f6e334c3d217884125f3a477f632be678f290f54b6fed8faf3f2174c1eeec008887121771a606afc912fbd53126cb7dae

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13e6e9eae0d947cb5bb0e13f63ef8b83e6d0ade03cdccdef052e9e20bc755e83

    • Size

      58KB

    • MD5

      8ce91eabb4065db7bed9fb6ebd336ea4

    • SHA1

      e9287ba26fd5b446d9bca8166b2e7b6e7b230444

    • SHA256

      13e6e9eae0d947cb5bb0e13f63ef8b83e6d0ade03cdccdef052e9e20bc755e83

    • SHA512

      8c1b5fbf60c66e6f24585cc806ce0c8f6e334c3d217884125f3a477f632be678f290f54b6fed8faf3f2174c1eeec008887121771a606afc912fbd53126cb7dae

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks