Overview

overview

10

Static

static

10

1341a4e9d6...27.exe

windows7_x64

10

1341a4e9d6...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1341a4e9d629bf2e40c00e2add7015c1cfaa3afd1bcc9e42e853632599d12127

  • Size

    99KB

  • Sample

    220212-fxzrcagdb9

  • MD5

    8962a85172d2c324409a9851d041f0ae

  • SHA1

    95bdce3e57b36f3015b6a53c4d97591d7ef6e440

  • SHA256

    1341a4e9d629bf2e40c00e2add7015c1cfaa3afd1bcc9e42e853632599d12127

  • SHA512

    485fe3c241eb049d9ffc32e6dcf52d119c9a1be8ebc9cca36161b832fa5128f76768342e281a88481a7a5f8a0ef982d223ffa4337b85495406e031fb2b913f66

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1341a4e9d629bf2e40c00e2add7015c1cfaa3afd1bcc9e42e853632599d12127

    • Size

      99KB

    • MD5

      8962a85172d2c324409a9851d041f0ae

    • SHA1

      95bdce3e57b36f3015b6a53c4d97591d7ef6e440

    • SHA256

      1341a4e9d629bf2e40c00e2add7015c1cfaa3afd1bcc9e42e853632599d12127

    • SHA512

      485fe3c241eb049d9ffc32e6dcf52d119c9a1be8ebc9cca36161b832fa5128f76768342e281a88481a7a5f8a0ef982d223ffa4337b85495406e031fb2b913f66

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks