Overview

overview

10

Static

static

11ef8a2f83...f8.exe

windows7_x64

10

11ef8a2f83...f8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11ef8a2f83edc44c757d7b2bb6b75edeaf172931c927cd9a644100eac71532f8

  • Size

    58KB

  • Sample

    220212-gd6k8aacaq

  • MD5

    9db1a91fc84b4dcd1546cf244b4069c4

  • SHA1

    387d624d5feb0c056743af79f33a3fadd284410b

  • SHA256

    11ef8a2f83edc44c757d7b2bb6b75edeaf172931c927cd9a644100eac71532f8

  • SHA512

    62743259d2ef7edc8f5544ccd1527039c2245fa62396eca5d93fd73d30f641235f9f78293af25a3d01a2e592536b2ccb5fea3e46a3cc4eec2ba241e44a3e5d94

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11ef8a2f83edc44c757d7b2bb6b75edeaf172931c927cd9a644100eac71532f8

    • Size

      58KB

    • MD5

      9db1a91fc84b4dcd1546cf244b4069c4

    • SHA1

      387d624d5feb0c056743af79f33a3fadd284410b

    • SHA256

      11ef8a2f83edc44c757d7b2bb6b75edeaf172931c927cd9a644100eac71532f8

    • SHA512

      62743259d2ef7edc8f5544ccd1527039c2245fa62396eca5d93fd73d30f641235f9f78293af25a3d01a2e592536b2ccb5fea3e46a3cc4eec2ba241e44a3e5d94

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks