Overview

overview

10

Static

static

10

1038f53253...8e.exe

windows7_x64

10

1038f53253...8e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1038f53253f5e53e5a792fe0645de955c40f2b7da0b403c627aaa6cb54825e8e

  • Size

    92KB

  • Sample

    220212-g4m7kahab6

  • MD5

    2ec9a649a96f78e6e86bb93622850afa

  • SHA1

    4cb8fa59ff016aa1f1b002e51091c3559e690e48

  • SHA256

    1038f53253f5e53e5a792fe0645de955c40f2b7da0b403c627aaa6cb54825e8e

  • SHA512

    ef6d33a3c910d7e71f2ca53f53252cb97842378720efb58ef81b2ae21340c528aef0576e5732709bcd6696398f5bc2665b62757f79987b25875e6124d9a4dcc2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1038f53253f5e53e5a792fe0645de955c40f2b7da0b403c627aaa6cb54825e8e

    • Size

      92KB

    • MD5

      2ec9a649a96f78e6e86bb93622850afa

    • SHA1

      4cb8fa59ff016aa1f1b002e51091c3559e690e48

    • SHA256

      1038f53253f5e53e5a792fe0645de955c40f2b7da0b403c627aaa6cb54825e8e

    • SHA512

      ef6d33a3c910d7e71f2ca53f53252cb97842378720efb58ef81b2ae21340c528aef0576e5732709bcd6696398f5bc2665b62757f79987b25875e6124d9a4dcc2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks