Overview

overview

10

Static

static

10

13cde76cb6...bc.exe

windows7_x64

10

13cde76cb6...bc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13cde76cb6e5038e6484dc430e4397c007e4da8b20a98d99ce1ea6b8e88ffbbc

  • Size

    150KB

  • Sample

    220212-fpf92agcc7

  • MD5

    045287445b1f6cccdd8106003910e50b

  • SHA1

    c596b8a635df6b0038953ae348e126cd538ba51d

  • SHA256

    13cde76cb6e5038e6484dc430e4397c007e4da8b20a98d99ce1ea6b8e88ffbbc

  • SHA512

    ca1fa57fd01c958524a925ad9d957c582f5e9e907253635549c3e656d25b5a8f8f0053e76d429fce7708064dbb73f28a3183fb2b11d57e42bd424ec8ccd61162

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13cde76cb6e5038e6484dc430e4397c007e4da8b20a98d99ce1ea6b8e88ffbbc

    • Size

      150KB

    • MD5

      045287445b1f6cccdd8106003910e50b

    • SHA1

      c596b8a635df6b0038953ae348e126cd538ba51d

    • SHA256

      13cde76cb6e5038e6484dc430e4397c007e4da8b20a98d99ce1ea6b8e88ffbbc

    • SHA512

      ca1fa57fd01c958524a925ad9d957c582f5e9e907253635549c3e656d25b5a8f8f0053e76d429fce7708064dbb73f28a3183fb2b11d57e42bd424ec8ccd61162

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks