Overview

overview

10

Static

static

10

131034ac29...b0.exe

windows7_x64

10

131034ac29...b0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    131034ac291d31b6688a35a570fa9a8d0a20df8ab1c8e0a16553e12cab035ab0

  • Size

    99KB

  • Sample

    220212-fz6mnsgde5

  • MD5

    ff043d850aa99146aea13c1eacddd9c7

  • SHA1

    5a4aff36c661ecb93cb602171b44c83fa052a0ad

  • SHA256

    131034ac291d31b6688a35a570fa9a8d0a20df8ab1c8e0a16553e12cab035ab0

  • SHA512

    cec25aabcbe86f50a6c69ebd39280496daf471d2b6f12780cc1932bd3c6eb98a112243856b55e71054e24b6006a5b3e4529a512522cd4055bc440599a913c55c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      131034ac291d31b6688a35a570fa9a8d0a20df8ab1c8e0a16553e12cab035ab0

    • Size

      99KB

    • MD5

      ff043d850aa99146aea13c1eacddd9c7

    • SHA1

      5a4aff36c661ecb93cb602171b44c83fa052a0ad

    • SHA256

      131034ac291d31b6688a35a570fa9a8d0a20df8ab1c8e0a16553e12cab035ab0

    • SHA512

      cec25aabcbe86f50a6c69ebd39280496daf471d2b6f12780cc1932bd3c6eb98a112243856b55e71054e24b6006a5b3e4529a512522cd4055bc440599a913c55c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks