Overview

overview

10

Static

static

132cdfb1ac...d6.exe

windows7_x64

10

132cdfb1ac...d6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    132cdfb1ac0fb21148e9613bf3a7234b497e5440ebe1a8b088a29426254452d6

  • Size

    36KB

  • Sample

    220212-fyzsqsaabn

  • MD5

    6f93c7a27d166bb1136c5d18a2bc9721

  • SHA1

    d2d62914c5e5c9f9ab4f6d7d00b2d6a118ca6ade

  • SHA256

    132cdfb1ac0fb21148e9613bf3a7234b497e5440ebe1a8b088a29426254452d6

  • SHA512

    12e43b77ea0dff2e45fab116ad3d72ba494b3e2fc087ff7056c044f1904fc99cb9d6cc4398bbf2c728d1bf727c7cabb7133c52830ca113cfaadf7e189f7b9e0b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      132cdfb1ac0fb21148e9613bf3a7234b497e5440ebe1a8b088a29426254452d6

    • Size

      36KB

    • MD5

      6f93c7a27d166bb1136c5d18a2bc9721

    • SHA1

      d2d62914c5e5c9f9ab4f6d7d00b2d6a118ca6ade

    • SHA256

      132cdfb1ac0fb21148e9613bf3a7234b497e5440ebe1a8b088a29426254452d6

    • SHA512

      12e43b77ea0dff2e45fab116ad3d72ba494b3e2fc087ff7056c044f1904fc99cb9d6cc4398bbf2c728d1bf727c7cabb7133c52830ca113cfaadf7e189f7b9e0b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks