Overview

overview

10

Static

static

13631d11c3...da.exe

windows7_x64

10

13631d11c3...da.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13631d11c3bb4f016b2a8391228d8cb858fc5585a87947f2e7bd0183183fdcda

  • Size

    60KB

  • Sample

    220212-fwckesgda2

  • MD5

    8660d144f5b3e2c344780a4235661daa

  • SHA1

    74f4efcaddb8589690c0b8ca8e3bb41770f80110

  • SHA256

    13631d11c3bb4f016b2a8391228d8cb858fc5585a87947f2e7bd0183183fdcda

  • SHA512

    85263010e0ddb842a77b246fdd35a25fea4b7f30f4f384e4a79c66200fff2a568efbf507248cfa523a84d67cf43993633e938a2d805e1b09e7cb7e13d30da03c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      13631d11c3bb4f016b2a8391228d8cb858fc5585a87947f2e7bd0183183fdcda

    • Size

      60KB

    • MD5

      8660d144f5b3e2c344780a4235661daa

    • SHA1

      74f4efcaddb8589690c0b8ca8e3bb41770f80110

    • SHA256

      13631d11c3bb4f016b2a8391228d8cb858fc5585a87947f2e7bd0183183fdcda

    • SHA512

      85263010e0ddb842a77b246fdd35a25fea4b7f30f4f384e4a79c66200fff2a568efbf507248cfa523a84d67cf43993633e938a2d805e1b09e7cb7e13d30da03c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks