Overview

overview

10

Static

static

10

139d0c8f0c...81.exe

windows7_x64

10

139d0c8f0c...81.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    139d0c8f0cbe11ea2f0bdedadb95d4fd66f589cc8aca2ca0f163f06f217ff681

  • Size

    99KB

  • Sample

    220212-fr9dlahhdm

  • MD5

    db1ac161c4c29f5c6dc9aa3390c66554

  • SHA1

    d0ba0a7a24eda5790e7ae0afdcb5132e5f298ce8

  • SHA256

    139d0c8f0cbe11ea2f0bdedadb95d4fd66f589cc8aca2ca0f163f06f217ff681

  • SHA512

    b463f4644dc4a894b3972f8db3f41ae2ab2723e42f7a3af05c97fb7fecc4bd37501821654f31ea86cd053ffb3b8e0eedfeb9fccebeb7b965d93b06319388316f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      139d0c8f0cbe11ea2f0bdedadb95d4fd66f589cc8aca2ca0f163f06f217ff681

    • Size

      99KB

    • MD5

      db1ac161c4c29f5c6dc9aa3390c66554

    • SHA1

      d0ba0a7a24eda5790e7ae0afdcb5132e5f298ce8

    • SHA256

      139d0c8f0cbe11ea2f0bdedadb95d4fd66f589cc8aca2ca0f163f06f217ff681

    • SHA512

      b463f4644dc4a894b3972f8db3f41ae2ab2723e42f7a3af05c97fb7fecc4bd37501821654f31ea86cd053ffb3b8e0eedfeb9fccebeb7b965d93b06319388316f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks