Overview

overview

10

Static

static

13c9f71430...96.exe

windows7_x64

10

13c9f71430...96.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13c9f7143089222820b34cb309b8e19530519e5f3f80db589bff6984fc1d8796

  • Size

    35KB

  • Sample

    220212-fpv37agcd2

  • MD5

    3e63be59618cd25d5a65ac0f179e269e

  • SHA1

    07b498e71d29be5bcfb55c5d4f2fe8dba720ad72

  • SHA256

    13c9f7143089222820b34cb309b8e19530519e5f3f80db589bff6984fc1d8796

  • SHA512

    de4d68298626892bf1e759746258f11c13e89a0fcb97cdfc1c6a2f825eb61de9a36e1b5243d5fec60a427361e6e87ef8ab22255f8e2692823c471d4c411b896f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13c9f7143089222820b34cb309b8e19530519e5f3f80db589bff6984fc1d8796

    • Size

      35KB

    • MD5

      3e63be59618cd25d5a65ac0f179e269e

    • SHA1

      07b498e71d29be5bcfb55c5d4f2fe8dba720ad72

    • SHA256

      13c9f7143089222820b34cb309b8e19530519e5f3f80db589bff6984fc1d8796

    • SHA512

      de4d68298626892bf1e759746258f11c13e89a0fcb97cdfc1c6a2f825eb61de9a36e1b5243d5fec60a427361e6e87ef8ab22255f8e2692823c471d4c411b896f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks