Overview

overview

10

Static

static

10

1139eebcce...ff.exe

windows7_x64

10

1139eebcce...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1139eebcce7c784cf977d9a82491df6da24dfafb0c68b9e0ea964b5d161806ff

  • Size

    80KB

  • Sample

    220212-gn3bjsggc7

  • MD5

    d4f42427c490c6f37a3fa74c54d39376

  • SHA1

    a937bfa1ed33147e48dc3e0391631d91fdea59c7

  • SHA256

    1139eebcce7c784cf977d9a82491df6da24dfafb0c68b9e0ea964b5d161806ff

  • SHA512

    b976232e3d31b48ead260449772a11b9b18d2cc6f89e6c1f5546dbdce8594b97c8030afceb95a694c3b655242670ef38baa92c803a7c3b98cfdcf8b702f746a3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1139eebcce7c784cf977d9a82491df6da24dfafb0c68b9e0ea964b5d161806ff

    • Size

      80KB

    • MD5

      d4f42427c490c6f37a3fa74c54d39376

    • SHA1

      a937bfa1ed33147e48dc3e0391631d91fdea59c7

    • SHA256

      1139eebcce7c784cf977d9a82491df6da24dfafb0c68b9e0ea964b5d161806ff

    • SHA512

      b976232e3d31b48ead260449772a11b9b18d2cc6f89e6c1f5546dbdce8594b97c8030afceb95a694c3b655242670ef38baa92c803a7c3b98cfdcf8b702f746a3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks