Overview

overview

10

Static

static

10

11913ab806...ac.exe

windows7_x64

10

11913ab806...ac.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac

  • Size

    100KB

  • Sample

    220212-gjlg8sgff4

  • MD5

    bb7b88ebf1a2ceb062328282abd3b418

  • SHA1

    75431ee6b26b547b9999431950046081d2cf1e5c

  • SHA256

    11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac

  • SHA512

    2e229e613d5ef1976c0e2f4ba16ca60220c37570f1ca6515591367f5bffd31faccb24d3a4a285d0f3bb991bc9dd9fbdd031b679b6dfc4167b7a66b00b383147d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac

    • Size

      100KB

    • MD5

      bb7b88ebf1a2ceb062328282abd3b418

    • SHA1

      75431ee6b26b547b9999431950046081d2cf1e5c

    • SHA256

      11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac

    • SHA512

      2e229e613d5ef1976c0e2f4ba16ca60220c37570f1ca6515591367f5bffd31faccb24d3a4a285d0f3bb991bc9dd9fbdd031b679b6dfc4167b7a66b00b383147d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks