Overview

overview

10

Static

static

10

114e6020e4...94.exe

windows7_x64

10

114e6020e4...94.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    114e6020e45028cb7097880a05e455ca87a765acd9393cd8ea0f3acb46aeab94

  • Size

    101KB

  • Sample

    220212-gm512sggb5

  • MD5

    ba1f0b76bbd52541d92b4646e0d4b8d8

  • SHA1

    89c614a9942aab49c77301b9adf1f91c925a827c

  • SHA256

    114e6020e45028cb7097880a05e455ca87a765acd9393cd8ea0f3acb46aeab94

  • SHA512

    a55728650a0cc480317a76f5842ada1eb980b43c4205ad65beb2dcecdf565af2a16601f56aea7ede375bbc19307dd175d37fd0d5a838454ba52f59ca295c0da9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      114e6020e45028cb7097880a05e455ca87a765acd9393cd8ea0f3acb46aeab94

    • Size

      101KB

    • MD5

      ba1f0b76bbd52541d92b4646e0d4b8d8

    • SHA1

      89c614a9942aab49c77301b9adf1f91c925a827c

    • SHA256

      114e6020e45028cb7097880a05e455ca87a765acd9393cd8ea0f3acb46aeab94

    • SHA512

      a55728650a0cc480317a76f5842ada1eb980b43c4205ad65beb2dcecdf565af2a16601f56aea7ede375bbc19307dd175d37fd0d5a838454ba52f59ca295c0da9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks