Overview

overview

10

Static

static

13a09fcde6...64.exe

windows7_x64

10

13a09fcde6...64.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564

  • Size

    35KB

  • Sample

    220212-fr3aaagcf6

  • MD5

    5191dced48f9ec50433d367582e188d7

  • SHA1

    85580e6428b65cc0506bce899157c0065eac1748

  • SHA256

    13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564

  • SHA512

    d8f4906ebd82a6bbe3b8912d93569ad226b4884ddfee4e86c752f0425c4eae752789eb701dbf1b29c28eff898b9653810228e6f1caf9f0d9d809b84086f42c07

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564

    • Size

      35KB

    • MD5

      5191dced48f9ec50433d367582e188d7

    • SHA1

      85580e6428b65cc0506bce899157c0065eac1748

    • SHA256

      13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564

    • SHA512

      d8f4906ebd82a6bbe3b8912d93569ad226b4884ddfee4e86c752f0425c4eae752789eb701dbf1b29c28eff898b9653810228e6f1caf9f0d9d809b84086f42c07

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks