Overview

overview

10

Static

static

1390c03e0c...1b.exe

windows7_x64

10

1390c03e0c...1b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1390c03e0cd0f9e425b3ed7e855282456f58f2d685d87f8cf92c535cf87f111b

  • Size

    58KB

  • Sample

    220212-fsntaahhej

  • MD5

    fd20d2d60e25993bea1f0a88ffd459bb

  • SHA1

    82a95ed195246c4d7950137ab8bf5e3e4b9ecd3d

  • SHA256

    1390c03e0cd0f9e425b3ed7e855282456f58f2d685d87f8cf92c535cf87f111b

  • SHA512

    b6fb57f0557a1ca10486b7cf03053e3c87a25772da32960508c2c19a662537f9f7a42d317a89bd7fb6032e2e6872f45217a6fde242b5f13400838aaac846e1b7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1390c03e0cd0f9e425b3ed7e855282456f58f2d685d87f8cf92c535cf87f111b

    • Size

      58KB

    • MD5

      fd20d2d60e25993bea1f0a88ffd459bb

    • SHA1

      82a95ed195246c4d7950137ab8bf5e3e4b9ecd3d

    • SHA256

      1390c03e0cd0f9e425b3ed7e855282456f58f2d685d87f8cf92c535cf87f111b

    • SHA512

      b6fb57f0557a1ca10486b7cf03053e3c87a25772da32960508c2c19a662537f9f7a42d317a89bd7fb6032e2e6872f45217a6fde242b5f13400838aaac846e1b7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks