Overview

overview

10

Static

static

10

11feef37d7...99.exe

windows7_x64

10

11feef37d7...99.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11feef37d7314fa182595b6d815e82a00e168cd4f1cbe5400621c7eedc0a1e99

  • Size

    99KB

  • Sample

    220212-gdr3tsgeh8

  • MD5

    19044820870b2d56edf45d0c6787c146

  • SHA1

    71eb56012f98e04dff55e259c56656d4c2d90567

  • SHA256

    11feef37d7314fa182595b6d815e82a00e168cd4f1cbe5400621c7eedc0a1e99

  • SHA512

    66d76af31924632dbb20d8f75c5b849fdef7b2e1f8065df569f73306022f90d6666efbe40104c2dd3a20eb2af90a4999597982fc7eb475d459cf5f3c940af644

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11feef37d7314fa182595b6d815e82a00e168cd4f1cbe5400621c7eedc0a1e99

    • Size

      99KB

    • MD5

      19044820870b2d56edf45d0c6787c146

    • SHA1

      71eb56012f98e04dff55e259c56656d4c2d90567

    • SHA256

      11feef37d7314fa182595b6d815e82a00e168cd4f1cbe5400621c7eedc0a1e99

    • SHA512

      66d76af31924632dbb20d8f75c5b849fdef7b2e1f8065df569f73306022f90d6666efbe40104c2dd3a20eb2af90a4999597982fc7eb475d459cf5f3c940af644

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks