Overview

overview

10

Static

static

1116b62b03...30.exe

windows7_x64

10

1116b62b03...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1116b62b037f87d2d659b5e8fafe319ca42ea32d257d63a3fbe10e27e5fd4630

  • Size

    60KB

  • Sample

    220212-gq6rragge9

  • MD5

    dac04e5271a4739eeb30669a529b392c

  • SHA1

    985386b255688065a8618c75b987a7d059ca3c99

  • SHA256

    1116b62b037f87d2d659b5e8fafe319ca42ea32d257d63a3fbe10e27e5fd4630

  • SHA512

    a065e089301f9ca5ed5d643a701257182275d9930105b929244a06780a9844cd985f9d3b85a68e556e337edc6213b550f6b602107bba073141a522722aa96daf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1116b62b037f87d2d659b5e8fafe319ca42ea32d257d63a3fbe10e27e5fd4630

    • Size

      60KB

    • MD5

      dac04e5271a4739eeb30669a529b392c

    • SHA1

      985386b255688065a8618c75b987a7d059ca3c99

    • SHA256

      1116b62b037f87d2d659b5e8fafe319ca42ea32d257d63a3fbe10e27e5fd4630

    • SHA512

      a065e089301f9ca5ed5d643a701257182275d9930105b929244a06780a9844cd985f9d3b85a68e556e337edc6213b550f6b602107bba073141a522722aa96daf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks