Overview

overview

10

Static

static

10002d5578...42.exe

windows7_x64

10

10002d5578...42.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10002d557807cbe17bc9a1daf7945299bfbb8a0b7b2b098a7ee489091d755742

  • Size

    58KB

  • Sample

    220212-g7gtyshae8

  • MD5

    ab481ca1139b5ea186335a34e7afa826

  • SHA1

    7f1f194878e96c6e2f9a9a7000fd4ff287253fd1

  • SHA256

    10002d557807cbe17bc9a1daf7945299bfbb8a0b7b2b098a7ee489091d755742

  • SHA512

    9a64331615a8d75bb192756b9c20363760167fa52d0010ee3f47a368e5c5499ce6211b35d76c2cfd26622b2ff1e17a39d4d210538fa67c60758ba62f857119e3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10002d557807cbe17bc9a1daf7945299bfbb8a0b7b2b098a7ee489091d755742

    • Size

      58KB

    • MD5

      ab481ca1139b5ea186335a34e7afa826

    • SHA1

      7f1f194878e96c6e2f9a9a7000fd4ff287253fd1

    • SHA256

      10002d557807cbe17bc9a1daf7945299bfbb8a0b7b2b098a7ee489091d755742

    • SHA512

      9a64331615a8d75bb192756b9c20363760167fa52d0010ee3f47a368e5c5499ce6211b35d76c2cfd26622b2ff1e17a39d4d210538fa67c60758ba62f857119e3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks