Overview

overview

10

Static

static

13d1018c76...02.exe

windows7_x64

10

13d1018c76...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13d1018c768eddf44110d3b5a5f8dead7cd54398f4adfa7a1defdb1a5d2f5302

  • Size

    60KB

  • Sample

    220212-fn5k8shhan

  • MD5

    066739d15c4f64aab25bfc4c5a5b6a8e

  • SHA1

    b06442f24d040eaff219090c2547ccb9e332f745

  • SHA256

    13d1018c768eddf44110d3b5a5f8dead7cd54398f4adfa7a1defdb1a5d2f5302

  • SHA512

    1c1f3a7a3945be898de8694eee671e6b58d9c404a4d83427cc20807a490f74af7221e45628e2074075b533cb1caaa4a7fe1e4a5eb44e481a52815d33f9fa4e81

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13d1018c768eddf44110d3b5a5f8dead7cd54398f4adfa7a1defdb1a5d2f5302

    • Size

      60KB

    • MD5

      066739d15c4f64aab25bfc4c5a5b6a8e

    • SHA1

      b06442f24d040eaff219090c2547ccb9e332f745

    • SHA256

      13d1018c768eddf44110d3b5a5f8dead7cd54398f4adfa7a1defdb1a5d2f5302

    • SHA512

      1c1f3a7a3945be898de8694eee671e6b58d9c404a4d83427cc20807a490f74af7221e45628e2074075b533cb1caaa4a7fe1e4a5eb44e481a52815d33f9fa4e81

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks