Overview

overview

10

Static

static

10

11a1878dff...6b.exe

windows7_x64

10

11a1878dff...6b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11a1878dff5ef56ed5b1c2f534afac7dd7e60a2bd46f37f4e59440a9b04c396b

  • Size

    216KB

  • Sample

    220212-ghwa2sgfe8

  • MD5

    a65daee6c8559daee438135e3691dd5d

  • SHA1

    122b40fbede11ec9e7e6aa6cc92c9646ac8d24fd

  • SHA256

    11a1878dff5ef56ed5b1c2f534afac7dd7e60a2bd46f37f4e59440a9b04c396b

  • SHA512

    e619b06bb8a476e7f2b57f94a330ae7e9c24b8f4e4fa81ab8c82db9e55815fe45e5dae430dea9b3b84118121556bea2090648c0ba24012dd8eafd31c60c8e4ea

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11a1878dff5ef56ed5b1c2f534afac7dd7e60a2bd46f37f4e59440a9b04c396b

    • Size

      216KB

    • MD5

      a65daee6c8559daee438135e3691dd5d

    • SHA1

      122b40fbede11ec9e7e6aa6cc92c9646ac8d24fd

    • SHA256

      11a1878dff5ef56ed5b1c2f534afac7dd7e60a2bd46f37f4e59440a9b04c396b

    • SHA512

      e619b06bb8a476e7f2b57f94a330ae7e9c24b8f4e4fa81ab8c82db9e55815fe45e5dae430dea9b3b84118121556bea2090648c0ba24012dd8eafd31c60c8e4ea

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks