Overview

overview

10

Static

static

10

137c627a02...28.exe

windows7_x64

10

137c627a02...28.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    137c627a027aa4304858d4b0f9a965c48ea26db5ecdfe0373d1f1852149e7928

  • Size

    216KB

  • Sample

    220212-ftxsksgcg8

  • MD5

    3ebe40f8bf7af5c75651a363cf3ee82d

  • SHA1

    4c955b4d2870ac035284b11e86919fc105cb5548

  • SHA256

    137c627a027aa4304858d4b0f9a965c48ea26db5ecdfe0373d1f1852149e7928

  • SHA512

    4766d54b0f937e0f8511abf658039cf7b98206857114767671e41a3cefbaa0445d5419df31495b855e230df64b5bf60f50b28621137cca46c7d5f4fbfedaef77

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      137c627a027aa4304858d4b0f9a965c48ea26db5ecdfe0373d1f1852149e7928

    • Size

      216KB

    • MD5

      3ebe40f8bf7af5c75651a363cf3ee82d

    • SHA1

      4c955b4d2870ac035284b11e86919fc105cb5548

    • SHA256

      137c627a027aa4304858d4b0f9a965c48ea26db5ecdfe0373d1f1852149e7928

    • SHA512

      4766d54b0f937e0f8511abf658039cf7b98206857114767671e41a3cefbaa0445d5419df31495b855e230df64b5bf60f50b28621137cca46c7d5f4fbfedaef77

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks