Overview

overview

10

Static

static

10

11e16cf17f...cb.exe

windows7_x64

10

11e16cf17f...cb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11e16cf17f3d2cf6b31ad14660dc844695efd3b546b83cf6466fea800250c4cb

  • Size

    101KB

  • Sample

    220212-gemvhagfa6

  • MD5

    809b577877422e0dd3d4932264322ceb

  • SHA1

    9089a1164cec4a268c3d0f35125d9d72b8026637

  • SHA256

    11e16cf17f3d2cf6b31ad14660dc844695efd3b546b83cf6466fea800250c4cb

  • SHA512

    11e5294f9f956d6a4a8ecff1e52e879e49fcaf7d8f800e8c4bbcebe3e8fb9935707cc60450f06112ccdf99435aa10038b32851a506a9619f069a72bca90f895c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11e16cf17f3d2cf6b31ad14660dc844695efd3b546b83cf6466fea800250c4cb

    • Size

      101KB

    • MD5

      809b577877422e0dd3d4932264322ceb

    • SHA1

      9089a1164cec4a268c3d0f35125d9d72b8026637

    • SHA256

      11e16cf17f3d2cf6b31ad14660dc844695efd3b546b83cf6466fea800250c4cb

    • SHA512

      11e5294f9f956d6a4a8ecff1e52e879e49fcaf7d8f800e8c4bbcebe3e8fb9935707cc60450f06112ccdf99435aa10038b32851a506a9619f069a72bca90f895c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks