Overview

overview

10

Static

static

12337e7695...a4.exe

windows7_x64

10

12337e7695...a4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12337e76955cadf935e3a19f4020b27ee01c0a4effff2fc13d5ea85a614545a4

  • Size

    35KB

  • Sample

    220212-ga56aagef8

  • MD5

    f640997f50eb0d46efc1e8278f9478c3

  • SHA1

    382a16c273096771972c8d651f0721113b4034ef

  • SHA256

    12337e76955cadf935e3a19f4020b27ee01c0a4effff2fc13d5ea85a614545a4

  • SHA512

    f80f231958be8557c570388c4bef2c792a5d7a84fd6c5850842a3e5c59403a47ec0c4209933755846d2ae0a0cedf63731a31a7c8afeaa7db65179bc3a5580120

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      12337e76955cadf935e3a19f4020b27ee01c0a4effff2fc13d5ea85a614545a4

    • Size

      35KB

    • MD5

      f640997f50eb0d46efc1e8278f9478c3

    • SHA1

      382a16c273096771972c8d651f0721113b4034ef

    • SHA256

      12337e76955cadf935e3a19f4020b27ee01c0a4effff2fc13d5ea85a614545a4

    • SHA512

      f80f231958be8557c570388c4bef2c792a5d7a84fd6c5850842a3e5c59403a47ec0c4209933755846d2ae0a0cedf63731a31a7c8afeaa7db65179bc3a5580120

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks