Overview

overview

10

Static

static

1348b105bd...46.exe

windows7_x64

10

1348b105bd...46.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1348b105bd80a611b2ef1dfcfd7a8455b3505168ece7a00866e56e5974af3646

  • Size

    60KB

  • Sample

    220212-fxsm2agdb7

  • MD5

    3f473e52f03de112c4326af4578d6dc7

  • SHA1

    fa325d1744f946ab0d8f6d612cdf26180eb1ba72

  • SHA256

    1348b105bd80a611b2ef1dfcfd7a8455b3505168ece7a00866e56e5974af3646

  • SHA512

    8315b06d26698420e23651374d1d4e08521a52d780f072f883ca7cca92f299026f396a1119ce25d7dae6a344d5045b4d43da902c97a16a74a8b77adac945a3b0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1348b105bd80a611b2ef1dfcfd7a8455b3505168ece7a00866e56e5974af3646

    • Size

      60KB

    • MD5

      3f473e52f03de112c4326af4578d6dc7

    • SHA1

      fa325d1744f946ab0d8f6d612cdf26180eb1ba72

    • SHA256

      1348b105bd80a611b2ef1dfcfd7a8455b3505168ece7a00866e56e5974af3646

    • SHA512

      8315b06d26698420e23651374d1d4e08521a52d780f072f883ca7cca92f299026f396a1119ce25d7dae6a344d5045b4d43da902c97a16a74a8b77adac945a3b0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks