Overview

overview

10

Static

static

10

13b4689407...c2.exe

windows7_x64

10

13b4689407...c2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13b4689407c70248b84bb0da1acee762bdfabf47d21326590ed43ac80fcd20c2

  • Size

    192KB

  • Sample

    220212-fq28wsgce3

  • MD5

    8bd20112e1cd9d03d67be6c2bab54bd1

  • SHA1

    d9d34f8d0eea6be79ae253bed7f3c2d097058c55

  • SHA256

    13b4689407c70248b84bb0da1acee762bdfabf47d21326590ed43ac80fcd20c2

  • SHA512

    0f1545f1b86dfd56c2e941e94b2617870b7faca594f7aade8475a327b3d108ea99ce8a2b0e6e536ea2d814686e70916b241ed6671f2aa732323268c84c30250f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13b4689407c70248b84bb0da1acee762bdfabf47d21326590ed43ac80fcd20c2

    • Size

      192KB

    • MD5

      8bd20112e1cd9d03d67be6c2bab54bd1

    • SHA1

      d9d34f8d0eea6be79ae253bed7f3c2d097058c55

    • SHA256

      13b4689407c70248b84bb0da1acee762bdfabf47d21326590ed43ac80fcd20c2

    • SHA512

      0f1545f1b86dfd56c2e941e94b2617870b7faca594f7aade8475a327b3d108ea99ce8a2b0e6e536ea2d814686e70916b241ed6671f2aa732323268c84c30250f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks