Overview

overview

10

Static

static

13adb4e0b7...f5.exe

windows7_x64

10

13adb4e0b7...f5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13adb4e0b746afc1815f1236d2574604d32adca336abcc0d990be4fc6888f9f5

  • Size

    35KB

  • Sample

    220212-fq7hlshhcq

  • MD5

    ec21ccd5b599e8075063f66817c56e58

  • SHA1

    1c2be6204ed1e4ff27cfd62cbe3373f07447435e

  • SHA256

    13adb4e0b746afc1815f1236d2574604d32adca336abcc0d990be4fc6888f9f5

  • SHA512

    1f4737bca6b01320dfaef65c650dd7b3c65bc37acccf30e3c9bf1a3d30c20c56dd17c3afd2bbb9402bce8b2bd15e5e7d2035624db1eeac515cb3cb8fe5e46eb7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13adb4e0b746afc1815f1236d2574604d32adca336abcc0d990be4fc6888f9f5

    • Size

      35KB

    • MD5

      ec21ccd5b599e8075063f66817c56e58

    • SHA1

      1c2be6204ed1e4ff27cfd62cbe3373f07447435e

    • SHA256

      13adb4e0b746afc1815f1236d2574604d32adca336abcc0d990be4fc6888f9f5

    • SHA512

      1f4737bca6b01320dfaef65c650dd7b3c65bc37acccf30e3c9bf1a3d30c20c56dd17c3afd2bbb9402bce8b2bd15e5e7d2035624db1eeac515cb3cb8fe5e46eb7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks