Overview

overview

10

Static

static

10ff64c7e6...47.exe

windows7_x64

10

10ff64c7e6...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10ff64c7e6da83ea8bb45fc74e37683680833b9c39cdc2dd9c18738d888afa47

  • Size

    35KB

  • Sample

    220212-gsagbsadej

  • MD5

    691bbc1d4d273068c91e464b2a800da4

  • SHA1

    5fa3c8727528f444fb9954c34479d06cb2f1845d

  • SHA256

    10ff64c7e6da83ea8bb45fc74e37683680833b9c39cdc2dd9c18738d888afa47

  • SHA512

    ce361f90c472d02bec672939df11344dcb038f6bd396739de787933ba533848330b1dee43bd6c8ad546f62c92fa7235a5b4a115d8c8ed0c11b8c73ce39643234

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10ff64c7e6da83ea8bb45fc74e37683680833b9c39cdc2dd9c18738d888afa47

    • Size

      35KB

    • MD5

      691bbc1d4d273068c91e464b2a800da4

    • SHA1

      5fa3c8727528f444fb9954c34479d06cb2f1845d

    • SHA256

      10ff64c7e6da83ea8bb45fc74e37683680833b9c39cdc2dd9c18738d888afa47

    • SHA512

      ce361f90c472d02bec672939df11344dcb038f6bd396739de787933ba533848330b1dee43bd6c8ad546f62c92fa7235a5b4a115d8c8ed0c11b8c73ce39643234

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks