Overview

overview

10

Static

static

10

131a33b6ac...62.exe

windows7_x64

10

131a33b6ac...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    131a33b6acf4b0c76a2141634dc9f80128df16fc861b9cb5a2ef2ad7336a4962

  • Size

    99KB

  • Sample

    220212-fzpzxsaacm

  • MD5

    ecb1591b423246248a9988a38de0eee9

  • SHA1

    d75b9d3ec42e80230450681cd5480a3bae3218e6

  • SHA256

    131a33b6acf4b0c76a2141634dc9f80128df16fc861b9cb5a2ef2ad7336a4962

  • SHA512

    6c6470b95a565aeec511f218911c1f3bf0b883e1d8a3e7892f6645eef37bd40b3443912a0441561d5918f86c87da59bfc93c457ed579346cda0c43bf55d187eb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      131a33b6acf4b0c76a2141634dc9f80128df16fc861b9cb5a2ef2ad7336a4962

    • Size

      99KB

    • MD5

      ecb1591b423246248a9988a38de0eee9

    • SHA1

      d75b9d3ec42e80230450681cd5480a3bae3218e6

    • SHA256

      131a33b6acf4b0c76a2141634dc9f80128df16fc861b9cb5a2ef2ad7336a4962

    • SHA512

      6c6470b95a565aeec511f218911c1f3bf0b883e1d8a3e7892f6645eef37bd40b3443912a0441561d5918f86c87da59bfc93c457ed579346cda0c43bf55d187eb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks