Overview

overview

10

Static

static

10

137205460b...54.exe

windows7_x64

10

137205460b...54.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    137205460b1bf8b8e01fc89765ec04758113d503f8749b72c04ef7cb96837954

  • Size

    80KB

  • Sample

    220212-fvc5kahhgk

  • MD5

    dd3396b94733a5b9841ccf3448c811a1

  • SHA1

    5dd8267ef66b8723dfa1a131af4d4195be485aae

  • SHA256

    137205460b1bf8b8e01fc89765ec04758113d503f8749b72c04ef7cb96837954

  • SHA512

    485993107ae4ba25aa54355189935e850f51aeff368e9ca57cc03e811e994e08bb3669141f182ed3c218f1e4fd15ecf3e0f6be12577c61bac45c6918b1df9432

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      137205460b1bf8b8e01fc89765ec04758113d503f8749b72c04ef7cb96837954

    • Size

      80KB

    • MD5

      dd3396b94733a5b9841ccf3448c811a1

    • SHA1

      5dd8267ef66b8723dfa1a131af4d4195be485aae

    • SHA256

      137205460b1bf8b8e01fc89765ec04758113d503f8749b72c04ef7cb96837954

    • SHA512

      485993107ae4ba25aa54355189935e850f51aeff368e9ca57cc03e811e994e08bb3669141f182ed3c218f1e4fd15ecf3e0f6be12577c61bac45c6918b1df9432

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks