Overview

overview

10

Static

static

10fb3ce22c...cf.exe

windows7_x64

10

10fb3ce22c...cf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10fb3ce22c291ab7c191863acba567a9af11af6c35658f0dedb18368c1ac39cf

  • Size

    35KB

  • Sample

    220212-gsclpaadek

  • MD5

    516c4dbbfa5208dd711c617fc6d4aa64

  • SHA1

    1e4b8d7f4f33983666dd3cc65a9bce4c5b5a0aad

  • SHA256

    10fb3ce22c291ab7c191863acba567a9af11af6c35658f0dedb18368c1ac39cf

  • SHA512

    f521068a76b51c83651b04cc335175133e1df8f14025a43fc0f7e5d2f98b07314f81e360604e8d895def269edf2dc5769a871ad71efbe1759de2cb548cfe11b2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10fb3ce22c291ab7c191863acba567a9af11af6c35658f0dedb18368c1ac39cf

    • Size

      35KB

    • MD5

      516c4dbbfa5208dd711c617fc6d4aa64

    • SHA1

      1e4b8d7f4f33983666dd3cc65a9bce4c5b5a0aad

    • SHA256

      10fb3ce22c291ab7c191863acba567a9af11af6c35658f0dedb18368c1ac39cf

    • SHA512

      f521068a76b51c83651b04cc335175133e1df8f14025a43fc0f7e5d2f98b07314f81e360604e8d895def269edf2dc5769a871ad71efbe1759de2cb548cfe11b2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks