Overview

overview

10

Static

static

11406986f8...bc.exe

windows7_x64

10

11406986f8...bc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11406986f84b94e2517d64dc9204891d61ec20f3d76aaed399b050a1380568bc

  • Size

    60KB

  • Sample

    220212-gnlc2aadal

  • MD5

    1b8db6ae8b946c9dadfe2f64f0f4a853

  • SHA1

    edb4ed1467e7ff5eb7b1872f6acd136a14a7e8f3

  • SHA256

    11406986f84b94e2517d64dc9204891d61ec20f3d76aaed399b050a1380568bc

  • SHA512

    2e06a516ff6e800b4e085b72887136bce650e054bdc34f3bec3e5b9a3a5cf832f11e285ede6c97aea17443a84f12eb0e663bba756fd403832faff4f41af30796

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11406986f84b94e2517d64dc9204891d61ec20f3d76aaed399b050a1380568bc

    • Size

      60KB

    • MD5

      1b8db6ae8b946c9dadfe2f64f0f4a853

    • SHA1

      edb4ed1467e7ff5eb7b1872f6acd136a14a7e8f3

    • SHA256

      11406986f84b94e2517d64dc9204891d61ec20f3d76aaed399b050a1380568bc

    • SHA512

      2e06a516ff6e800b4e085b72887136bce650e054bdc34f3bec3e5b9a3a5cf832f11e285ede6c97aea17443a84f12eb0e663bba756fd403832faff4f41af30796

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks