Overview

overview

10

Static

static

1352ede98c...e2.exe

windows7_x64

10

1352ede98c...e2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1352ede98c2ce5c91d832c7da831efd2214c003bd05d7f827c78dd83f449e0e2

  • Size

    58KB

  • Sample

    220212-fxagfsgdb4

  • MD5

    6107a1dc52b73a0ae709445fa4d7db63

  • SHA1

    02b0f17a8b96a00269ef631a3a971ef58ae41d4a

  • SHA256

    1352ede98c2ce5c91d832c7da831efd2214c003bd05d7f827c78dd83f449e0e2

  • SHA512

    98f60a97cfdf6b905165a31b379da144b3bcbd4838284214b4d6757bba1e9e499349ba2f3d11cace8c4d251d77e3829d883b2b99709d9fe7ffb352908353a0f7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1352ede98c2ce5c91d832c7da831efd2214c003bd05d7f827c78dd83f449e0e2

    • Size

      58KB

    • MD5

      6107a1dc52b73a0ae709445fa4d7db63

    • SHA1

      02b0f17a8b96a00269ef631a3a971ef58ae41d4a

    • SHA256

      1352ede98c2ce5c91d832c7da831efd2214c003bd05d7f827c78dd83f449e0e2

    • SHA512

      98f60a97cfdf6b905165a31b379da144b3bcbd4838284214b4d6757bba1e9e499349ba2f3d11cace8c4d251d77e3829d883b2b99709d9fe7ffb352908353a0f7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks