Overview

overview

10

Static

static

137cb6b7bc...4d.exe

windows7_x64

10

137cb6b7bc...4d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    137cb6b7bcb15f3ae48c27adf9aabf744a2f6d73addd4caaa3a09d56f873a24d

  • Size

    35KB

  • Sample

    220212-ftvyzsgcg7

  • MD5

    f1555c34f0c065ee0b27302c96be348f

  • SHA1

    1e35336804b1bddcb4e9ec5554461d0f31146d1b

  • SHA256

    137cb6b7bcb15f3ae48c27adf9aabf744a2f6d73addd4caaa3a09d56f873a24d

  • SHA512

    d1394ae44fdaf040ee397875a684bc7afcd6896927283c2fdca29fec8709227a85934611a20b8ffaf640beeaedf6d11670ecd734e37bc42e2ca6a65155cc9ed1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      137cb6b7bcb15f3ae48c27adf9aabf744a2f6d73addd4caaa3a09d56f873a24d

    • Size

      35KB

    • MD5

      f1555c34f0c065ee0b27302c96be348f

    • SHA1

      1e35336804b1bddcb4e9ec5554461d0f31146d1b

    • SHA256

      137cb6b7bcb15f3ae48c27adf9aabf744a2f6d73addd4caaa3a09d56f873a24d

    • SHA512

      d1394ae44fdaf040ee397875a684bc7afcd6896927283c2fdca29fec8709227a85934611a20b8ffaf640beeaedf6d11670ecd734e37bc42e2ca6a65155cc9ed1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks