Overview

overview

10

Static

static

10

13d8a6f67b...8d.exe

windows7_x64

10

13d8a6f67b...8d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13d8a6f67b1349a0ccc38e111152402189ee6d94ed538efcf8b30f2fa9a5868d

  • Size

    99KB

  • Sample

    220212-fnqr3shhak

  • MD5

    f646bbbe297cec816542af34edcaebaf

  • SHA1

    5688e0bfa73e4efd29528658acdc25b9a34be775

  • SHA256

    13d8a6f67b1349a0ccc38e111152402189ee6d94ed538efcf8b30f2fa9a5868d

  • SHA512

    89638935d89e5725bad467d5f3c1cb039692bf424a11dfe655dcfd0bd814f8708618808edde178e0975cb2a2b80cdefbbd642434c97fc1f2f936ef150e73bcfb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13d8a6f67b1349a0ccc38e111152402189ee6d94ed538efcf8b30f2fa9a5868d

    • Size

      99KB

    • MD5

      f646bbbe297cec816542af34edcaebaf

    • SHA1

      5688e0bfa73e4efd29528658acdc25b9a34be775

    • SHA256

      13d8a6f67b1349a0ccc38e111152402189ee6d94ed538efcf8b30f2fa9a5868d

    • SHA512

      89638935d89e5725bad467d5f3c1cb039692bf424a11dfe655dcfd0bd814f8708618808edde178e0975cb2a2b80cdefbbd642434c97fc1f2f936ef150e73bcfb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks