Overview

overview

10

Static

static

117500e7e3...6f.exe

windows7_x64

10

117500e7e3...6f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    117500e7e32fddb851fcee23a978fdf44657484f965bfb35e2ad2d477bf4416f

  • Size

    58KB

  • Sample

    220212-gkpw2sacfp

  • MD5

    152c26784b9b8ece2d78d3772d163051

  • SHA1

    ebd75ac182790fdd64ece46b5f73aa7f5fb0b07b

  • SHA256

    117500e7e32fddb851fcee23a978fdf44657484f965bfb35e2ad2d477bf4416f

  • SHA512

    175f620a0ad1557bf563ab4d809eed7a88b2054ea8a24142e899c1577dcd0a6eef639fcf8f8f2b694e1ed82ab90477db1bb5103f9e7b6e642a89b81fe4eaa560

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      117500e7e32fddb851fcee23a978fdf44657484f965bfb35e2ad2d477bf4416f

    • Size

      58KB

    • MD5

      152c26784b9b8ece2d78d3772d163051

    • SHA1

      ebd75ac182790fdd64ece46b5f73aa7f5fb0b07b

    • SHA256

      117500e7e32fddb851fcee23a978fdf44657484f965bfb35e2ad2d477bf4416f

    • SHA512

      175f620a0ad1557bf563ab4d809eed7a88b2054ea8a24142e899c1577dcd0a6eef639fcf8f8f2b694e1ed82ab90477db1bb5103f9e7b6e642a89b81fe4eaa560

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks