Overview

overview

10

Static

static

117da95ff9...ab.exe

windows7_x64

10

117da95ff9...ab.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    117da95ff930aa6f958a2b5224d4954a5f119df1c3b4688124ed0399eae177ab

  • Size

    58KB

  • Sample

    220212-gkfy5sgfg5

  • MD5

    928a7d496b6088de01f3998200118ca8

  • SHA1

    41fc815989fdcb364000e8c42632962072e9a31c

  • SHA256

    117da95ff930aa6f958a2b5224d4954a5f119df1c3b4688124ed0399eae177ab

  • SHA512

    7a1aa2dccf744496a5c08ef77c387160f7eac208553e53dfeebc521cd5934da7e76137a23e5f9bf1416a32067fc7949b91fd1b4871f7817d92fb268f7a9fec19

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      117da95ff930aa6f958a2b5224d4954a5f119df1c3b4688124ed0399eae177ab

    • Size

      58KB

    • MD5

      928a7d496b6088de01f3998200118ca8

    • SHA1

      41fc815989fdcb364000e8c42632962072e9a31c

    • SHA256

      117da95ff930aa6f958a2b5224d4954a5f119df1c3b4688124ed0399eae177ab

    • SHA512

      7a1aa2dccf744496a5c08ef77c387160f7eac208553e53dfeebc521cd5934da7e76137a23e5f9bf1416a32067fc7949b91fd1b4871f7817d92fb268f7a9fec19

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks