Overview

overview

10

Static

static

10

1192e52749...55.exe

windows7_x64

10

1192e52749...55.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1192e52749cba91fa164fd1adafb5f112e089c08483dd4c4b16a70adfb691555

  • Size

    192KB

  • Sample

    220212-gjjcwaacep

  • MD5

    3ce4e9b3c39a37c72f7321f4b89e9c38

  • SHA1

    312e868cfd2926635a8a4c2dc166ee38c420567c

  • SHA256

    1192e52749cba91fa164fd1adafb5f112e089c08483dd4c4b16a70adfb691555

  • SHA512

    3abb4acfb5ec2888ed928082cc428ca151e1cd3b67903f44a5e25dab032bfa021b449b3f7852912fc9f33a253bac452430fdc9620006c29b65f33367598b07ff

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1192e52749cba91fa164fd1adafb5f112e089c08483dd4c4b16a70adfb691555

    • Size

      192KB

    • MD5

      3ce4e9b3c39a37c72f7321f4b89e9c38

    • SHA1

      312e868cfd2926635a8a4c2dc166ee38c420567c

    • SHA256

      1192e52749cba91fa164fd1adafb5f112e089c08483dd4c4b16a70adfb691555

    • SHA512

      3abb4acfb5ec2888ed928082cc428ca151e1cd3b67903f44a5e25dab032bfa021b449b3f7852912fc9f33a253bac452430fdc9620006c29b65f33367598b07ff

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks