Overview

overview

10

Static

static

112fd5f7b1...d9.exe

windows7_x64

10

112fd5f7b1...d9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    112fd5f7b1dbc1a25e916764c5430793c7b277307b2a623fc782a416a695f0d9

  • Size

    58KB

  • Sample

    220212-gplp7aggd5

  • MD5

    d331a5b4a05feeba83947fbfb8f46efa

  • SHA1

    35d62248fdf84ed4a6a44dd544a4e909e0ff2f49

  • SHA256

    112fd5f7b1dbc1a25e916764c5430793c7b277307b2a623fc782a416a695f0d9

  • SHA512

    2db7f730861a2e75783c1222126abe8b91116c0c85f6a30794bf16514fc7cb23159d75cee6726a80afacf4e0b06f43bc3aaef9a42c57a47b75bd659a37b240a1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      112fd5f7b1dbc1a25e916764c5430793c7b277307b2a623fc782a416a695f0d9

    • Size

      58KB

    • MD5

      d331a5b4a05feeba83947fbfb8f46efa

    • SHA1

      35d62248fdf84ed4a6a44dd544a4e909e0ff2f49

    • SHA256

      112fd5f7b1dbc1a25e916764c5430793c7b277307b2a623fc782a416a695f0d9

    • SHA512

      2db7f730861a2e75783c1222126abe8b91116c0c85f6a30794bf16514fc7cb23159d75cee6726a80afacf4e0b06f43bc3aaef9a42c57a47b75bd659a37b240a1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks