Overview

overview

10

Static

static

10

1324ba4d70...86.exe

windows7_x64

10

1324ba4d70...86.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1324ba4d70b1875c63031062e5f9d215d2b2092448e4abd87d088caa41248986

  • Size

    80KB

  • Sample

    220212-fzfq9agdd5

  • MD5

    84a004cda034ec5dfb98d7f5cd6d3d39

  • SHA1

    6c536c7dab7d4149c4aac1e4d5fa24644416b514

  • SHA256

    1324ba4d70b1875c63031062e5f9d215d2b2092448e4abd87d088caa41248986

  • SHA512

    64b502ab6b734da57b607be357073be4f05b906a4ea3a39aa62f67add6b1318f70328aaa15d06b4e21ca5c9600e95c85bd9533576f99bf6e2824bb049bd63a3f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1324ba4d70b1875c63031062e5f9d215d2b2092448e4abd87d088caa41248986

    • Size

      80KB

    • MD5

      84a004cda034ec5dfb98d7f5cd6d3d39

    • SHA1

      6c536c7dab7d4149c4aac1e4d5fa24644416b514

    • SHA256

      1324ba4d70b1875c63031062e5f9d215d2b2092448e4abd87d088caa41248986

    • SHA512

      64b502ab6b734da57b607be357073be4f05b906a4ea3a39aa62f67add6b1318f70328aaa15d06b4e21ca5c9600e95c85bd9533576f99bf6e2824bb049bd63a3f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks