Overview

overview

10

Static

static

10

13be35a3ed...8b.exe

windows7_x64

10

13be35a3ed...8b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13be35a3ed7948bde5559d7d61bee975f067142de94926b1aed686b35f83df8b

  • Size

    99KB

  • Sample

    220212-fqnqhagcd8

  • MD5

    6eb62ce9e1f79b8c724c7c03fefa3f0b

  • SHA1

    91d58869440fb57e902bb1e46113dd5d97d70048

  • SHA256

    13be35a3ed7948bde5559d7d61bee975f067142de94926b1aed686b35f83df8b

  • SHA512

    ef83b0f6f2739e72715d5b8a1b69bcb7de480ab8d82a33d7744eaa612ebfede8ce7ed3b6aa481e4ba6a872567454dc3c0ca26b562f44677faebbe38b975caba6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13be35a3ed7948bde5559d7d61bee975f067142de94926b1aed686b35f83df8b

    • Size

      99KB

    • MD5

      6eb62ce9e1f79b8c724c7c03fefa3f0b

    • SHA1

      91d58869440fb57e902bb1e46113dd5d97d70048

    • SHA256

      13be35a3ed7948bde5559d7d61bee975f067142de94926b1aed686b35f83df8b

    • SHA512

      ef83b0f6f2739e72715d5b8a1b69bcb7de480ab8d82a33d7744eaa612ebfede8ce7ed3b6aa481e4ba6a872567454dc3c0ca26b562f44677faebbe38b975caba6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks