Overview

overview

10

Static

static

11c5851b85...73.exe

windows7_x64

10

11c5851b85...73.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11c5851b8580a2f95b96631b31996dbea0ab8f5628d03e190ce33ebe38fe5073

  • Size

    36KB

  • Sample

    220212-gfyndsaccm

  • MD5

    c73aa935834c45208544470f708fc841

  • SHA1

    9d03d558350dd09dd58b70851c258a7e5a18e88a

  • SHA256

    11c5851b8580a2f95b96631b31996dbea0ab8f5628d03e190ce33ebe38fe5073

  • SHA512

    89e66a893855ff7ec2b2f3a94d2b5aac78f91213333d63a3cc2125faecd8be423fc74476ff116eee777b82e636f99a26ebde7d7451f59818712b38bdd8054f9f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11c5851b8580a2f95b96631b31996dbea0ab8f5628d03e190ce33ebe38fe5073

    • Size

      36KB

    • MD5

      c73aa935834c45208544470f708fc841

    • SHA1

      9d03d558350dd09dd58b70851c258a7e5a18e88a

    • SHA256

      11c5851b8580a2f95b96631b31996dbea0ab8f5628d03e190ce33ebe38fe5073

    • SHA512

      89e66a893855ff7ec2b2f3a94d2b5aac78f91213333d63a3cc2125faecd8be423fc74476ff116eee777b82e636f99a26ebde7d7451f59818712b38bdd8054f9f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks