Overview

overview

10

Static

static

10

13a19553f0...cb.exe

windows7_x64

10

13a19553f0...cb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13a19553f031fea5610ba8fb80f98aa851c396d46a82e4df329ae1862f47e3cb

  • Size

    151KB

  • Sample

    220212-frybbsgcf5

  • MD5

    3b905033c6c2691a59ae12d723d595ff

  • SHA1

    77a92706da1294ac43c170fc19466c6d07a6546c

  • SHA256

    13a19553f031fea5610ba8fb80f98aa851c396d46a82e4df329ae1862f47e3cb

  • SHA512

    03ab5c3661126a1030b842515a4479793aa1f441739e808d1f77dbe7a1dfb780449ca1a0101dec39160e08ee60b239c65ff9f9b74ef2f2b78102dc8b8e20a9f4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13a19553f031fea5610ba8fb80f98aa851c396d46a82e4df329ae1862f47e3cb

    • Size

      151KB

    • MD5

      3b905033c6c2691a59ae12d723d595ff

    • SHA1

      77a92706da1294ac43c170fc19466c6d07a6546c

    • SHA256

      13a19553f031fea5610ba8fb80f98aa851c396d46a82e4df329ae1862f47e3cb

    • SHA512

      03ab5c3661126a1030b842515a4479793aa1f441739e808d1f77dbe7a1dfb780449ca1a0101dec39160e08ee60b239c65ff9f9b74ef2f2b78102dc8b8e20a9f4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks