Overview

overview

10

Static

static

10

13c973de9c...b8.exe

windows7_x64

10

13c973de9c...b8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13c973de9cf0bf19bdc2166520fc9642c6b8759a604ca5971848bc10e13745b8

  • Size

    101KB

  • Sample

    220212-fp1cxagcd4

  • MD5

    6a75ba6d9e16c05f224d3ef41d7ff143

  • SHA1

    4e67625a7341475d3d28e9d6d42a74f3389a175d

  • SHA256

    13c973de9cf0bf19bdc2166520fc9642c6b8759a604ca5971848bc10e13745b8

  • SHA512

    1f8ba160ad1aa0030ece3e9ef44dc66d1a02cbe33e63cf6499977e2cb11b94960ebd4e7ff4fdc107eb63c6d0aef275c45f8f22146c7adf2f23cc3bc7c1bb40f9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13c973de9cf0bf19bdc2166520fc9642c6b8759a604ca5971848bc10e13745b8

    • Size

      101KB

    • MD5

      6a75ba6d9e16c05f224d3ef41d7ff143

    • SHA1

      4e67625a7341475d3d28e9d6d42a74f3389a175d

    • SHA256

      13c973de9cf0bf19bdc2166520fc9642c6b8759a604ca5971848bc10e13745b8

    • SHA512

      1f8ba160ad1aa0030ece3e9ef44dc66d1a02cbe33e63cf6499977e2cb11b94960ebd4e7ff4fdc107eb63c6d0aef275c45f8f22146c7adf2f23cc3bc7c1bb40f9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks