Overview

overview

10

Static

static

137a0d9894...07.exe

windows7_x64

10

137a0d9894...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07

  • Size

    58KB

  • Sample

    220212-ft23ashhfp

  • MD5

    919dabcbb17007661daf0ee628b56118

  • SHA1

    ef6740035b2f42892b79a36fa39db4a2091c7b58

  • SHA256

    137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07

  • SHA512

    537c132d6a9d7de861793616b119da3c7728fc7e8020e0afe9c5e22aa1768e5b5539cf8f8b386bc08028189f3b79c2d2d07af41d2e77bc70601dd4e1801fcc2a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07

    • Size

      58KB

    • MD5

      919dabcbb17007661daf0ee628b56118

    • SHA1

      ef6740035b2f42892b79a36fa39db4a2091c7b58

    • SHA256

      137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07

    • SHA512

      537c132d6a9d7de861793616b119da3c7728fc7e8020e0afe9c5e22aa1768e5b5539cf8f8b386bc08028189f3b79c2d2d07af41d2e77bc70601dd4e1801fcc2a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks