Overview

overview

10

Static

static

10f130e7a4...b3.exe

windows7_x64

10

10f130e7a4...b3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10f130e7a40319d7b2fc3e09d816f6afb9c56f286f9c32aafd8195c519ce0eb3

  • Size

    35KB

  • Sample

    220212-gs41yaader

  • MD5

    ead128b8b0c4425a7039fa9fb70eb217

  • SHA1

    3376422afe7452d31b846f10ee1413af8d302056

  • SHA256

    10f130e7a40319d7b2fc3e09d816f6afb9c56f286f9c32aafd8195c519ce0eb3

  • SHA512

    9c2dde0d1251c9ff3004dfa977ed13b2cd22d9305903f2f9ecc65b883d3f909b4eb18504d63a993da31cfa2f41ed46a1ee7925433c402dedc1af20b8b50783f0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10f130e7a40319d7b2fc3e09d816f6afb9c56f286f9c32aafd8195c519ce0eb3

    • Size

      35KB

    • MD5

      ead128b8b0c4425a7039fa9fb70eb217

    • SHA1

      3376422afe7452d31b846f10ee1413af8d302056

    • SHA256

      10f130e7a40319d7b2fc3e09d816f6afb9c56f286f9c32aafd8195c519ce0eb3

    • SHA512

      9c2dde0d1251c9ff3004dfa977ed13b2cd22d9305903f2f9ecc65b883d3f909b4eb18504d63a993da31cfa2f41ed46a1ee7925433c402dedc1af20b8b50783f0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks