Overview

overview

10

Static

static

10

11a2e86836...1d.exe

windows7_x64

10

11a2e86836...1d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11a2e868369fc5b9d0c1bc17043ef42f041f3e4589a4e36d014aaa2110af151d

  • Size

    176KB

  • Sample

    220212-ghs6pagfe7

  • MD5

    989e0ff22432aa6dba3d597f7e5a6a2e

  • SHA1

    15e4338a57431c5835402e981d545a7ac06a38ec

  • SHA256

    11a2e868369fc5b9d0c1bc17043ef42f041f3e4589a4e36d014aaa2110af151d

  • SHA512

    8c8788e2eab89f78022a71e74beaa55db0dc41729120fbbd2b7803ffa7a81a8f6996d530e30b0d2b5ebbb1ef3a19af877f8b17701bddab2e22cc6fddfd68469e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11a2e868369fc5b9d0c1bc17043ef42f041f3e4589a4e36d014aaa2110af151d

    • Size

      176KB

    • MD5

      989e0ff22432aa6dba3d597f7e5a6a2e

    • SHA1

      15e4338a57431c5835402e981d545a7ac06a38ec

    • SHA256

      11a2e868369fc5b9d0c1bc17043ef42f041f3e4589a4e36d014aaa2110af151d

    • SHA512

      8c8788e2eab89f78022a71e74beaa55db0dc41729120fbbd2b7803ffa7a81a8f6996d530e30b0d2b5ebbb1ef3a19af877f8b17701bddab2e22cc6fddfd68469e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks