Overview

overview

10

Static

static

10

10eebb5cae...bd.exe

windows7_x64

10

10eebb5cae...bd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10eebb5cae369a1aaaa8eca159b940114c14e34a2e31a04722ac272038e325bd

  • Size

    144KB

  • Sample

    220212-gs66asggg9

  • MD5

    c01ac940703a9d969d755ed34a4fe0da

  • SHA1

    d8697d9eb1528e677401262df8204e3f1eb6a732

  • SHA256

    10eebb5cae369a1aaaa8eca159b940114c14e34a2e31a04722ac272038e325bd

  • SHA512

    07d9363efb3b164d5d7ac7a6aaa17131781e3e467c0ccbf0ebbc71feb0ff28630b7dd7e532b1fdda829b7f97ce352c7f518c5c91825f7ae9fdf443883723ecb3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10eebb5cae369a1aaaa8eca159b940114c14e34a2e31a04722ac272038e325bd

    • Size

      144KB

    • MD5

      c01ac940703a9d969d755ed34a4fe0da

    • SHA1

      d8697d9eb1528e677401262df8204e3f1eb6a732

    • SHA256

      10eebb5cae369a1aaaa8eca159b940114c14e34a2e31a04722ac272038e325bd

    • SHA512

      07d9363efb3b164d5d7ac7a6aaa17131781e3e467c0ccbf0ebbc71feb0ff28630b7dd7e532b1fdda829b7f97ce352c7f518c5c91825f7ae9fdf443883723ecb3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks