Overview

overview

10

Static

static

10

1135f9bb57...ae.exe

windows7_x64

10

1135f9bb57...ae.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1135f9bb57e53c2e86cd04847220fa2f7bcabb7d2722139463c7ec790f17c2ae

  • Size

    192KB

  • Sample

    220212-gpamxsggd3

  • MD5

    13e6909c9cd932a1ec95fb0f18a5f4be

  • SHA1

    524de8e475da895f0f988328ed512b49ba647314

  • SHA256

    1135f9bb57e53c2e86cd04847220fa2f7bcabb7d2722139463c7ec790f17c2ae

  • SHA512

    7ac2995517a2a98431206e5892a18f20e201fd77cc36f5a1c93a2e0ac124683d5ea80c674b3659a4568575b55767c28a8e96023e70894abee1a71f43eeaeebc5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1135f9bb57e53c2e86cd04847220fa2f7bcabb7d2722139463c7ec790f17c2ae

    • Size

      192KB

    • MD5

      13e6909c9cd932a1ec95fb0f18a5f4be

    • SHA1

      524de8e475da895f0f988328ed512b49ba647314

    • SHA256

      1135f9bb57e53c2e86cd04847220fa2f7bcabb7d2722139463c7ec790f17c2ae

    • SHA512

      7ac2995517a2a98431206e5892a18f20e201fd77cc36f5a1c93a2e0ac124683d5ea80c674b3659a4568575b55767c28a8e96023e70894abee1a71f43eeaeebc5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks