Overview

overview

10

Static

static

10

13d97f32cc...a2.exe

windows7_x64

10

13d97f32cc...a2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13d97f32ccec56ee62741ff04f5d2a9ff11788869dba692819a2de4714f0bda2

  • Size

    191KB

  • Sample

    220212-fnnygsgcc2

  • MD5

    f43ed6fa39ea1075ffc6de743c75fd32

  • SHA1

    0f370c7d7144ba54dd4e29aed855cd1ed48d2cd4

  • SHA256

    13d97f32ccec56ee62741ff04f5d2a9ff11788869dba692819a2de4714f0bda2

  • SHA512

    94144d200d75ac45a06b5372742aad17d400713c4c6000cb681e7fb5339e8343941f497ef2a7cc323e199a00393ee0fc1907923d99c414aff0209a9851ff93dc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13d97f32ccec56ee62741ff04f5d2a9ff11788869dba692819a2de4714f0bda2

    • Size

      191KB

    • MD5

      f43ed6fa39ea1075ffc6de743c75fd32

    • SHA1

      0f370c7d7144ba54dd4e29aed855cd1ed48d2cd4

    • SHA256

      13d97f32ccec56ee62741ff04f5d2a9ff11788869dba692819a2de4714f0bda2

    • SHA512

      94144d200d75ac45a06b5372742aad17d400713c4c6000cb681e7fb5339e8343941f497ef2a7cc323e199a00393ee0fc1907923d99c414aff0209a9851ff93dc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks