Overview

overview

10

Static

static

122ce0419c...13.exe

windows7_x64

10

122ce0419c...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    122ce0419c3580eecb97bcb6f9733cf6003b4c95df1c104c9d607d72cbb09313

  • Size

    58KB

  • Sample

    220212-gbrz2sabfp

  • MD5

    7166a7c568522324d74e16e4efa0a3ca

  • SHA1

    903c381a1ca3a24fc2d72a4da9233cc5654b09b3

  • SHA256

    122ce0419c3580eecb97bcb6f9733cf6003b4c95df1c104c9d607d72cbb09313

  • SHA512

    6a0c08bcbb275a0dd1b2a1c1af456b426c97c18d6e3df72d7c1c94718e4ee3971a3cf45d8f7110c463761886c4c5d51c4d2088f5dad83e0aed32933de2028c28

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      122ce0419c3580eecb97bcb6f9733cf6003b4c95df1c104c9d607d72cbb09313

    • Size

      58KB

    • MD5

      7166a7c568522324d74e16e4efa0a3ca

    • SHA1

      903c381a1ca3a24fc2d72a4da9233cc5654b09b3

    • SHA256

      122ce0419c3580eecb97bcb6f9733cf6003b4c95df1c104c9d607d72cbb09313

    • SHA512

      6a0c08bcbb275a0dd1b2a1c1af456b426c97c18d6e3df72d7c1c94718e4ee3971a3cf45d8f7110c463761886c4c5d51c4d2088f5dad83e0aed32933de2028c28

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks