Overview

overview

10

Static

static

1070731f4b...1b.exe

windows7_x64

10

1070731f4b...1b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1070731f4b31fc778690f06516d2b138bd71845e68cb4ce3d88491a0d3f7111b

  • Size

    60KB

  • Sample

    220212-g1y5naghg6

  • MD5

    72f5f014cfdf459eacb36c7459177db8

  • SHA1

    68825938a3447df59acacb677c4647a16aa81996

  • SHA256

    1070731f4b31fc778690f06516d2b138bd71845e68cb4ce3d88491a0d3f7111b

  • SHA512

    8e75a7f871ba55752be850b241e608e8da17485ab4a93f10b74d401074d45680c3394275b391a7be0c1453e030102a93015b31c74c3cd75f6481e1135e5cb855

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1070731f4b31fc778690f06516d2b138bd71845e68cb4ce3d88491a0d3f7111b

    • Size

      60KB

    • MD5

      72f5f014cfdf459eacb36c7459177db8

    • SHA1

      68825938a3447df59acacb677c4647a16aa81996

    • SHA256

      1070731f4b31fc778690f06516d2b138bd71845e68cb4ce3d88491a0d3f7111b

    • SHA512

      8e75a7f871ba55752be850b241e608e8da17485ab4a93f10b74d401074d45680c3394275b391a7be0c1453e030102a93015b31c74c3cd75f6481e1135e5cb855

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks