Overview

overview

10

Static

static

10

1037dbe227...74.exe

windows7_x64

10

1037dbe227...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1037dbe227f75932a837a3085126ba97b66d5df2f2fb2ce6a7d3aae9d721d874

  • Size

    80KB

  • Sample

    220212-g4p16aaefq

  • MD5

    ed57e80e95c3d03c825a00772fdf9002

  • SHA1

    5d25bfe45df2aba0ae687b29eb9516bb4ec03eec

  • SHA256

    1037dbe227f75932a837a3085126ba97b66d5df2f2fb2ce6a7d3aae9d721d874

  • SHA512

    938c1c00e395710f67df5e85792405e9bdde3d555dee07b5b8a832ed267d3f2fd57ac05eae54d1132ac82967ef48e14e5a53c0131f22200fe0dec6001cd01e5a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1037dbe227f75932a837a3085126ba97b66d5df2f2fb2ce6a7d3aae9d721d874

    • Size

      80KB

    • MD5

      ed57e80e95c3d03c825a00772fdf9002

    • SHA1

      5d25bfe45df2aba0ae687b29eb9516bb4ec03eec

    • SHA256

      1037dbe227f75932a837a3085126ba97b66d5df2f2fb2ce6a7d3aae9d721d874

    • SHA512

      938c1c00e395710f67df5e85792405e9bdde3d555dee07b5b8a832ed267d3f2fd57ac05eae54d1132ac82967ef48e14e5a53c0131f22200fe0dec6001cd01e5a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks