Overview

overview

10

Static

static

1145adbd51...c0.exe

windows7_x64

10

1145adbd51...c0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1145adbd511e72871355d4810137744a16f63ee41a24d75ac9a57f34fba914c0

  • Size

    35KB

  • Sample

    220212-gnb5csggb8

  • MD5

    6c142ca02f802a041c8e154f33f13168

  • SHA1

    ef11624f8126cb0524bc5c78a4d19141cbbadea6

  • SHA256

    1145adbd511e72871355d4810137744a16f63ee41a24d75ac9a57f34fba914c0

  • SHA512

    cb758c6549d323ecbbaa85eea88e1eb6473d832c5c83d39dec21bba21373f30e8ddf908b557bfc01cb7122bee6b18d96b04cee95ee9817381b31647b4bbfb487

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1145adbd511e72871355d4810137744a16f63ee41a24d75ac9a57f34fba914c0

    • Size

      35KB

    • MD5

      6c142ca02f802a041c8e154f33f13168

    • SHA1

      ef11624f8126cb0524bc5c78a4d19141cbbadea6

    • SHA256

      1145adbd511e72871355d4810137744a16f63ee41a24d75ac9a57f34fba914c0

    • SHA512

      cb758c6549d323ecbbaa85eea88e1eb6473d832c5c83d39dec21bba21373f30e8ddf908b557bfc01cb7122bee6b18d96b04cee95ee9817381b31647b4bbfb487

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks