Overview

overview

10

Static

static

10

112428495e...f9.exe

windows7_x64

10

112428495e...f9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    112428495e8c29d8ad2715e334cec10f61e6be84b5b45351780368432e88f3f9

  • Size

    92KB

  • Sample

    220212-gqbavagge2

  • MD5

    b435a33fc61c24ec61a8d8fab94c29ac

  • SHA1

    9675ca7f23d928b4662690598c5f9af98f6043c3

  • SHA256

    112428495e8c29d8ad2715e334cec10f61e6be84b5b45351780368432e88f3f9

  • SHA512

    a8e98198b2fe6cf3cbd816b6a96a815ea6b66ab155bb139198ac1a1e393fb40f04021e53b309e5f3d0a023442f527b77970e18e5ce90163d089cda2bcdc4a92e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      112428495e8c29d8ad2715e334cec10f61e6be84b5b45351780368432e88f3f9

    • Size

      92KB

    • MD5

      b435a33fc61c24ec61a8d8fab94c29ac

    • SHA1

      9675ca7f23d928b4662690598c5f9af98f6043c3

    • SHA256

      112428495e8c29d8ad2715e334cec10f61e6be84b5b45351780368432e88f3f9

    • SHA512

      a8e98198b2fe6cf3cbd816b6a96a815ea6b66ab155bb139198ac1a1e393fb40f04021e53b309e5f3d0a023442f527b77970e18e5ce90163d089cda2bcdc4a92e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks