Overview

overview

10

Static

static

10f892f363...30.exe

windows7_x64

10

10f892f363...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10f892f363e0414af0ae0e2760b063ccbe0351394872a64590a43b1c42496130

  • Size

    60KB

  • Sample

    220212-gsq43sggg5

  • MD5

    728b40d64b2fe8e939cff9d32465d8ca

  • SHA1

    9c759aefd5490b68b5c59d107b241a9041b56c4b

  • SHA256

    10f892f363e0414af0ae0e2760b063ccbe0351394872a64590a43b1c42496130

  • SHA512

    f7fb524ee600794ca796d3a6f2ac0f15cb9ba09f5c37c69671d5c66d1942e23bfc2f7a4971d67c9955814ae63e48160bbf2ca525adb40fc68327074d9edf0b3f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10f892f363e0414af0ae0e2760b063ccbe0351394872a64590a43b1c42496130

    • Size

      60KB

    • MD5

      728b40d64b2fe8e939cff9d32465d8ca

    • SHA1

      9c759aefd5490b68b5c59d107b241a9041b56c4b

    • SHA256

      10f892f363e0414af0ae0e2760b063ccbe0351394872a64590a43b1c42496130

    • SHA512

      f7fb524ee600794ca796d3a6f2ac0f15cb9ba09f5c37c69671d5c66d1942e23bfc2f7a4971d67c9955814ae63e48160bbf2ca525adb40fc68327074d9edf0b3f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks