Overview

overview

10

Static

static

130de4aef3...db.exe

windows7_x64

10

130de4aef3...db.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    130de4aef3eef8186b12d5884730d2762098cd29de0bbfcf2fa772ac85bac7db

  • Size

    35KB

  • Sample

    220212-fz8f9sgde6

  • MD5

    2cd2809857984142aa483a2ed7b020ca

  • SHA1

    01851edce949169a114632e45b78602ffcf8654a

  • SHA256

    130de4aef3eef8186b12d5884730d2762098cd29de0bbfcf2fa772ac85bac7db

  • SHA512

    790127b139bf4e1a17829330089220bb52eef950fce0f212c38518c0090e0a79ab9acf835af130fec6e84d70dd1192dbdb24e603b0d2caa8f48261e246a90894

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      130de4aef3eef8186b12d5884730d2762098cd29de0bbfcf2fa772ac85bac7db

    • Size

      35KB

    • MD5

      2cd2809857984142aa483a2ed7b020ca

    • SHA1

      01851edce949169a114632e45b78602ffcf8654a

    • SHA256

      130de4aef3eef8186b12d5884730d2762098cd29de0bbfcf2fa772ac85bac7db

    • SHA512

      790127b139bf4e1a17829330089220bb52eef950fce0f212c38518c0090e0a79ab9acf835af130fec6e84d70dd1192dbdb24e603b0d2caa8f48261e246a90894

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks