Overview

overview

10

Static

static

104927054b...dc.exe

windows7_x64

10

104927054b...dc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    104927054be96c4fd99c43d93aa08fc67166e5f28a9c99a51679d0a5e96866dc

  • Size

    36KB

  • Sample

    220212-g3dazaaeen

  • MD5

    bddec481304bfd7c5d512493f0fcd53a

  • SHA1

    4aab3bf838085512b3acacd69aecfc11748577f9

  • SHA256

    104927054be96c4fd99c43d93aa08fc67166e5f28a9c99a51679d0a5e96866dc

  • SHA512

    09f8ff69623b235957052660b32d859d86ee64cd44a95e71512d831339e909320f8af2672aeebea18db5c5175370a830a490b5c675efbe515cc42e00f3da486e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      104927054be96c4fd99c43d93aa08fc67166e5f28a9c99a51679d0a5e96866dc

    • Size

      36KB

    • MD5

      bddec481304bfd7c5d512493f0fcd53a

    • SHA1

      4aab3bf838085512b3acacd69aecfc11748577f9

    • SHA256

      104927054be96c4fd99c43d93aa08fc67166e5f28a9c99a51679d0a5e96866dc

    • SHA512

      09f8ff69623b235957052660b32d859d86ee64cd44a95e71512d831339e909320f8af2672aeebea18db5c5175370a830a490b5c675efbe515cc42e00f3da486e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks