Overview

overview

10

Static

static

10

139f5092d5...68.exe

windows7_x64

10

139f5092d5...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    139f5092d557f01eb2f22bfae28620108a675a7cbe5c7060a84f56faf9207c68

  • Size

    80KB

  • Sample

    220212-fr5emsgcf7

  • MD5

    0e8e8c7d5ea11f7e7733cadec3ed5992

  • SHA1

    cc7cad1202e4267b27d90700fdf0db597e451e1f

  • SHA256

    139f5092d557f01eb2f22bfae28620108a675a7cbe5c7060a84f56faf9207c68

  • SHA512

    da3ef7c168e24463f9366bf973381cbf1f9ddcd35e1b3cd5a440723f6d6feb9606e2468dac37d6327b07634c0ed5bdabbf860f380384914cdc445bfd6fe06c57

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      139f5092d557f01eb2f22bfae28620108a675a7cbe5c7060a84f56faf9207c68

    • Size

      80KB

    • MD5

      0e8e8c7d5ea11f7e7733cadec3ed5992

    • SHA1

      cc7cad1202e4267b27d90700fdf0db597e451e1f

    • SHA256

      139f5092d557f01eb2f22bfae28620108a675a7cbe5c7060a84f56faf9207c68

    • SHA512

      da3ef7c168e24463f9366bf973381cbf1f9ddcd35e1b3cd5a440723f6d6feb9606e2468dac37d6327b07634c0ed5bdabbf860f380384914cdc445bfd6fe06c57

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks