Overview

overview

10

Static

static

113e66c340...91.exe

windows7_x64

10

113e66c340...91.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    113e66c3404b9e9c0a680706b40a6fab316cb39ede582c35470e994f46905591

  • Size

    58KB

  • Sample

    220212-gnsr4sggc3

  • MD5

    b228e33bf33c05c38d46ff3c9e91cfd7

  • SHA1

    0d08a72412bfad554b8be2caac2ff98e3424e043

  • SHA256

    113e66c3404b9e9c0a680706b40a6fab316cb39ede582c35470e994f46905591

  • SHA512

    d29b1785503812807fdb637d41319f0fa0db36d1ed1a1d8934549cb9b258b434d9f784b1d0ca53c215fed52fa0bef88d1f866af3a74827934f0f58bc2a326215

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      113e66c3404b9e9c0a680706b40a6fab316cb39ede582c35470e994f46905591

    • Size

      58KB

    • MD5

      b228e33bf33c05c38d46ff3c9e91cfd7

    • SHA1

      0d08a72412bfad554b8be2caac2ff98e3424e043

    • SHA256

      113e66c3404b9e9c0a680706b40a6fab316cb39ede582c35470e994f46905591

    • SHA512

      d29b1785503812807fdb637d41319f0fa0db36d1ed1a1d8934549cb9b258b434d9f784b1d0ca53c215fed52fa0bef88d1f866af3a74827934f0f58bc2a326215

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks