Overview

overview

10

Static

static

10

107157cb8a...7a.exe

windows7_x64

10

107157cb8a...7a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a

  • Size

    191KB

  • Sample

    220212-g1w1asaedk

  • MD5

    cc19d96496d2eab7423d7d17b257252c

  • SHA1

    125fb9164663ca108a493a061e630a759f562d47

  • SHA256

    107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a

  • SHA512

    0f9db9be57f918e35e10f9987f214b2f382e37ae6b62ae562941fd1ae29a66e9dd9e8504d8a3b59701c5e142d8e4e2f6d92fdacfd7d440514506746df9887a17

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a

    • Size

      191KB

    • MD5

      cc19d96496d2eab7423d7d17b257252c

    • SHA1

      125fb9164663ca108a493a061e630a759f562d47

    • SHA256

      107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a

    • SHA512

      0f9db9be57f918e35e10f9987f214b2f382e37ae6b62ae562941fd1ae29a66e9dd9e8504d8a3b59701c5e142d8e4e2f6d92fdacfd7d440514506746df9887a17

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks