Overview

overview

10

Static

static

11158ced62...71.exe

windows7_x64

10

11158ced62...71.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11158ced628300162ad39e3701658b8e37f35b5bb0b3c2d3a246a82b579d0f71

  • Size

    36KB

  • Sample

    220212-gq8lcaadcp

  • MD5

    9a719658483c4147e72c149e680b7ab1

  • SHA1

    b154c62d47c47e7d5a5c4c9efccbe0c2698e27c3

  • SHA256

    11158ced628300162ad39e3701658b8e37f35b5bb0b3c2d3a246a82b579d0f71

  • SHA512

    15633050b1f489d6ef929dd17114537521ad0298bfd04d46278e123b8c19de4fe38f07c29e27577efda855a5daa971c142f3864899be3473292ac818755ad2d2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      11158ced628300162ad39e3701658b8e37f35b5bb0b3c2d3a246a82b579d0f71

    • Size

      36KB

    • MD5

      9a719658483c4147e72c149e680b7ab1

    • SHA1

      b154c62d47c47e7d5a5c4c9efccbe0c2698e27c3

    • SHA256

      11158ced628300162ad39e3701658b8e37f35b5bb0b3c2d3a246a82b579d0f71

    • SHA512

      15633050b1f489d6ef929dd17114537521ad0298bfd04d46278e123b8c19de4fe38f07c29e27577efda855a5daa971c142f3864899be3473292ac818755ad2d2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks