Overview

overview

10

Static

static

11d5d2708b...63.exe

windows7_x64

10

11d5d2708b...63.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11d5d2708b2b5e442f3619bd92c26860c7e96196ee45bdc68c29515fa05a2463

  • Size

    35KB

  • Sample

    220212-ge8rzagfb4

  • MD5

    173c6eefd48a4f674d51ec90b05b1ce1

  • SHA1

    7a19afe5f1f81fb1759c856e7f688fc97e5f6e14

  • SHA256

    11d5d2708b2b5e442f3619bd92c26860c7e96196ee45bdc68c29515fa05a2463

  • SHA512

    c174d877e9eb4cc4a8d0908f1f0ea43d0648ac67eb43261ac72756bbf58a16d292ffeac285b074597391d2c5bcae37de0f7755e061e73f57e3795eea0223ef1a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11d5d2708b2b5e442f3619bd92c26860c7e96196ee45bdc68c29515fa05a2463

    • Size

      35KB

    • MD5

      173c6eefd48a4f674d51ec90b05b1ce1

    • SHA1

      7a19afe5f1f81fb1759c856e7f688fc97e5f6e14

    • SHA256

      11d5d2708b2b5e442f3619bd92c26860c7e96196ee45bdc68c29515fa05a2463

    • SHA512

      c174d877e9eb4cc4a8d0908f1f0ea43d0648ac67eb43261ac72756bbf58a16d292ffeac285b074597391d2c5bcae37de0f7755e061e73f57e3795eea0223ef1a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks