Overview

overview

10

Static

static

10

114fabe3ed...82.exe

windows7_x64

10

114fabe3ed...82.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    114fabe3eda3611c007d79ddd114c5072259114aeea663be13e62a1488ed8b82

  • Size

    104KB

  • Sample

    220212-gm1rbsachn

  • MD5

    48216b739a8684eca32713c2b6e409b7

  • SHA1

    4b2b4bb76651c9a5195e1c3c5262768ca8551c3d

  • SHA256

    114fabe3eda3611c007d79ddd114c5072259114aeea663be13e62a1488ed8b82

  • SHA512

    028f5082eff2bf10537b8c25e6b4513b65cc0438ed09695618aea08b328406783c4624f402bc0b80196c2ed9423d84d3b42eb8151e9e5441c80f3abc4f365dbc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      114fabe3eda3611c007d79ddd114c5072259114aeea663be13e62a1488ed8b82

    • Size

      104KB

    • MD5

      48216b739a8684eca32713c2b6e409b7

    • SHA1

      4b2b4bb76651c9a5195e1c3c5262768ca8551c3d

    • SHA256

      114fabe3eda3611c007d79ddd114c5072259114aeea663be13e62a1488ed8b82

    • SHA512

      028f5082eff2bf10537b8c25e6b4513b65cc0438ed09695618aea08b328406783c4624f402bc0b80196c2ed9423d84d3b42eb8151e9e5441c80f3abc4f365dbc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks