Overview

overview

10

Static

static

10

106eeee79f...02.exe

windows7_x64

10

106eeee79f...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    106eeee79f6e13cf8ae38ce66d40633df12e57d72be54ff0a6c302a185d10402

  • Size

    100KB

  • Sample

    220212-g134lsghg7

  • MD5

    576a4ffa72151fd371294306a8dad7ce

  • SHA1

    cad7a6e244a77eef211d1d91670f27d8cf82a91b

  • SHA256

    106eeee79f6e13cf8ae38ce66d40633df12e57d72be54ff0a6c302a185d10402

  • SHA512

    3f9016d8983b1074a07f152fd510cacf7b8d8254c91c3615ea282ea6386ff6586a0dea8246e4e079884c5a10a2047e406e1d6f0644eec2bf80a14cf563e05f36

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      106eeee79f6e13cf8ae38ce66d40633df12e57d72be54ff0a6c302a185d10402

    • Size

      100KB

    • MD5

      576a4ffa72151fd371294306a8dad7ce

    • SHA1

      cad7a6e244a77eef211d1d91670f27d8cf82a91b

    • SHA256

      106eeee79f6e13cf8ae38ce66d40633df12e57d72be54ff0a6c302a185d10402

    • SHA512

      3f9016d8983b1074a07f152fd510cacf7b8d8254c91c3615ea282ea6386ff6586a0dea8246e4e079884c5a10a2047e406e1d6f0644eec2bf80a14cf563e05f36

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks