Overview

overview

10

Static

static

1195e7f703...27.exe

windows7_x64

10

1195e7f703...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1195e7f703113daed4c3d4427907b1bc5b9e6ff99cc92b9dbc8a41c20ffb7927

  • Size

    36KB

  • Sample

    220212-gjd36aacem

  • MD5

    91ff2c73fefa0143a917008f0bf58b32

  • SHA1

    28af41da524e737917228e24b636238051ee0302

  • SHA256

    1195e7f703113daed4c3d4427907b1bc5b9e6ff99cc92b9dbc8a41c20ffb7927

  • SHA512

    b6aa6f0558fb592b503f1ba97975a61c6e247f7d9d3077effbaa6b7a5afbc87feb00a87e8c55f3f8a05547a6077649d84988bf186861d9c63b3dd2a62482a672

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1195e7f703113daed4c3d4427907b1bc5b9e6ff99cc92b9dbc8a41c20ffb7927

    • Size

      36KB

    • MD5

      91ff2c73fefa0143a917008f0bf58b32

    • SHA1

      28af41da524e737917228e24b636238051ee0302

    • SHA256

      1195e7f703113daed4c3d4427907b1bc5b9e6ff99cc92b9dbc8a41c20ffb7927

    • SHA512

      b6aa6f0558fb592b503f1ba97975a61c6e247f7d9d3077effbaa6b7a5afbc87feb00a87e8c55f3f8a05547a6077649d84988bf186861d9c63b3dd2a62482a672

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks