Overview

overview

10

Static

static

12351019d7...a1.exe

windows7_x64

10

12351019d7...a1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12351019d715a45e9d9e7c93d338e75726aefb0984cfd83db609dda44d6f62a1

  • Size

    35KB

  • Sample

    220212-ga31xsgef7

  • MD5

    ec2ca5c2818cec1c7cffb70b78753bac

  • SHA1

    7b118012ba8bad180848879b568b950892e923cc

  • SHA256

    12351019d715a45e9d9e7c93d338e75726aefb0984cfd83db609dda44d6f62a1

  • SHA512

    196ded2faaf85ca6f8d712499f744891b69e60892b4fbae3e681eb685925af9f8c7cf2eb196045f566dffe954891c03b244c270135001bc5f9fedb2528cb1307

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12351019d715a45e9d9e7c93d338e75726aefb0984cfd83db609dda44d6f62a1

    • Size

      35KB

    • MD5

      ec2ca5c2818cec1c7cffb70b78753bac

    • SHA1

      7b118012ba8bad180848879b568b950892e923cc

    • SHA256

      12351019d715a45e9d9e7c93d338e75726aefb0984cfd83db609dda44d6f62a1

    • SHA512

      196ded2faaf85ca6f8d712499f744891b69e60892b4fbae3e681eb685925af9f8c7cf2eb196045f566dffe954891c03b244c270135001bc5f9fedb2528cb1307

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks