Overview

overview

10

Static

static

1174a3184a...6e.exe

windows7_x64

10

1174a3184a...6e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1174a3184adeaa09f04a8ead11402f709826f190fc46444de51fabc82de3c56e

  • Size

    58KB

  • Sample

    220212-gkrqmsgfg7

  • MD5

    c653944fec62a5120c67fc91bd6d9ae2

  • SHA1

    16d4fde3e64b9c87c84598d9c5670f1dfb20ca4a

  • SHA256

    1174a3184adeaa09f04a8ead11402f709826f190fc46444de51fabc82de3c56e

  • SHA512

    505a601d1f9e738981d84dd89d314f6d2cd86d299858b2a4cf9f4ea1838962e089b048b6e06f86ca735085b8a88a33740ab33f989b7550e26dc53d10f8bce4ca

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1174a3184adeaa09f04a8ead11402f709826f190fc46444de51fabc82de3c56e

    • Size

      58KB

    • MD5

      c653944fec62a5120c67fc91bd6d9ae2

    • SHA1

      16d4fde3e64b9c87c84598d9c5670f1dfb20ca4a

    • SHA256

      1174a3184adeaa09f04a8ead11402f709826f190fc46444de51fabc82de3c56e

    • SHA512

      505a601d1f9e738981d84dd89d314f6d2cd86d299858b2a4cf9f4ea1838962e089b048b6e06f86ca735085b8a88a33740ab33f989b7550e26dc53d10f8bce4ca

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks