Overview

overview

10

Static

static

13c7b84c04...7e.exe

windows7_x64

10

13c7b84c04...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13c7b84c048de25d6e9209a70b70ec06d8ac54325180ed142af935e3883fa57e

  • Size

    60KB

  • Sample

    220212-fp5mmahhbp

  • MD5

    554c32c667571d6047e4eb5538320c3c

  • SHA1

    2b5280608832d62382aa15ca5c9c523c02d9e279

  • SHA256

    13c7b84c048de25d6e9209a70b70ec06d8ac54325180ed142af935e3883fa57e

  • SHA512

    0517a1d5df77d530d37a5c0d9a49e735fba6dd1f6936aa27b1a5bd1f004cd960d2ef5ad4b5e7392855ec23343f475e8f8b764d6edf763a1c5201795fbebdec0a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13c7b84c048de25d6e9209a70b70ec06d8ac54325180ed142af935e3883fa57e

    • Size

      60KB

    • MD5

      554c32c667571d6047e4eb5538320c3c

    • SHA1

      2b5280608832d62382aa15ca5c9c523c02d9e279

    • SHA256

      13c7b84c048de25d6e9209a70b70ec06d8ac54325180ed142af935e3883fa57e

    • SHA512

      0517a1d5df77d530d37a5c0d9a49e735fba6dd1f6936aa27b1a5bd1f004cd960d2ef5ad4b5e7392855ec23343f475e8f8b764d6edf763a1c5201795fbebdec0a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks