Overview

overview

10

Static

static

10

100e0abafa...94.exe

windows7_x64

10

100e0abafa...94.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    100e0abafa4a91f3361d47595e18650ad07cd452cf5a14efb27545a74ef0f694

  • Size

    216KB

  • Sample

    220212-g6tr5ahad9

  • MD5

    442edbff0ebd8c65f2ed6765e996df39

  • SHA1

    c8c184a9b3d41f7ceb97b4b12dd9ee9ad73951b8

  • SHA256

    100e0abafa4a91f3361d47595e18650ad07cd452cf5a14efb27545a74ef0f694

  • SHA512

    09cc9a33acd3b4cbd9afa8ab5eb1d03c64572b53c5acff8799598e01be3ad9fcac85da3629251c52a8588043bbcec0bd50b1a714017a271d066a5092a435de02

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      100e0abafa4a91f3361d47595e18650ad07cd452cf5a14efb27545a74ef0f694

    • Size

      216KB

    • MD5

      442edbff0ebd8c65f2ed6765e996df39

    • SHA1

      c8c184a9b3d41f7ceb97b4b12dd9ee9ad73951b8

    • SHA256

      100e0abafa4a91f3361d47595e18650ad07cd452cf5a14efb27545a74ef0f694

    • SHA512

      09cc9a33acd3b4cbd9afa8ab5eb1d03c64572b53c5acff8799598e01be3ad9fcac85da3629251c52a8588043bbcec0bd50b1a714017a271d066a5092a435de02

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks