Overview

overview

10

Static

static

10

110424f1d0...25.exe

windows7_x64

10

110424f1d0...25.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    110424f1d0a32b2dde22abc188793832f38fe5fd28e8c05c1f9d6a2453fa8b25

  • Size

    99KB

  • Sample

    220212-gr8mqsaddr

  • MD5

    1c8dab60c1ed3d723615cf08569c0e22

  • SHA1

    09b3376d4974e887a01ffb0e42f13f92c0ca9d79

  • SHA256

    110424f1d0a32b2dde22abc188793832f38fe5fd28e8c05c1f9d6a2453fa8b25

  • SHA512

    ff93f6fe428051f68a8069e2b728db06b97a4d5d392b733e171ed57f1861574c7e1f588cfde18f223f39691fe6a2fde07ce2b8649db8a6ee4ae1a889f47d86ee

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      110424f1d0a32b2dde22abc188793832f38fe5fd28e8c05c1f9d6a2453fa8b25

    • Size

      99KB

    • MD5

      1c8dab60c1ed3d723615cf08569c0e22

    • SHA1

      09b3376d4974e887a01ffb0e42f13f92c0ca9d79

    • SHA256

      110424f1d0a32b2dde22abc188793832f38fe5fd28e8c05c1f9d6a2453fa8b25

    • SHA512

      ff93f6fe428051f68a8069e2b728db06b97a4d5d392b733e171ed57f1861574c7e1f588cfde18f223f39691fe6a2fde07ce2b8649db8a6ee4ae1a889f47d86ee

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks