Overview

overview

10

Static

static

10

11bd46f867...3c.exe

windows7_x64

10

11bd46f867...3c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11bd46f867d0c3f6e13155ea6a99d0873da938f3f12760caa258d4374a46b73c

  • Size

    99KB

  • Sample

    220212-ggea5sgfc8

  • MD5

    08b06eae6907bbea1304906adb240815

  • SHA1

    62ac8842dc23e8a7dcb5e76e202b6933a96121f6

  • SHA256

    11bd46f867d0c3f6e13155ea6a99d0873da938f3f12760caa258d4374a46b73c

  • SHA512

    3ecda73fb2ad5ce557aba99bb9667e360b42e4b5d3d15323c0c65d0929aa97063392fb3e4a9d5e5e54d54f2208b2d835e8b4a7d07729ce230c884ce543b1446a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11bd46f867d0c3f6e13155ea6a99d0873da938f3f12760caa258d4374a46b73c

    • Size

      99KB

    • MD5

      08b06eae6907bbea1304906adb240815

    • SHA1

      62ac8842dc23e8a7dcb5e76e202b6933a96121f6

    • SHA256

      11bd46f867d0c3f6e13155ea6a99d0873da938f3f12760caa258d4374a46b73c

    • SHA512

      3ecda73fb2ad5ce557aba99bb9667e360b42e4b5d3d15323c0c65d0929aa97063392fb3e4a9d5e5e54d54f2208b2d835e8b4a7d07729ce230c884ce543b1446a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks