Overview

overview

10

Static

static

10

101e33509e...53.exe

windows7_x64

10

101e33509e...53.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    101e33509e688508c996ce344e61f2765fd01491cbabdfff536a781898a97b53

  • Size

    216KB

  • Sample

    220212-g5x36ahac8

  • MD5

    4b84392c6de66c2d73f9213fed639a50

  • SHA1

    370670b28287e2db55e33937e7f54f5cd2a5b3a7

  • SHA256

    101e33509e688508c996ce344e61f2765fd01491cbabdfff536a781898a97b53

  • SHA512

    309c117a9c1013a84c28e211f64d69afdef6b6ba3cea57e9341921b396722d059aee800045321e51880d8f9d686a4e09a97f780550a7747093f412ce33d20c16

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      101e33509e688508c996ce344e61f2765fd01491cbabdfff536a781898a97b53

    • Size

      216KB

    • MD5

      4b84392c6de66c2d73f9213fed639a50

    • SHA1

      370670b28287e2db55e33937e7f54f5cd2a5b3a7

    • SHA256

      101e33509e688508c996ce344e61f2765fd01491cbabdfff536a781898a97b53

    • SHA512

      309c117a9c1013a84c28e211f64d69afdef6b6ba3cea57e9341921b396722d059aee800045321e51880d8f9d686a4e09a97f780550a7747093f412ce33d20c16

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks