Overview

overview

10

Static

static

10

10bca2a88b...91.exe

windows7_x64

10

10bca2a88b...91.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10bca2a88b6fa182aac5f7423fa25c80f40fe37f5b697d5a7df48b0f597f0291

  • Size

    99KB

  • Sample

    220212-gv1fjaadgn

  • MD5

    7d1fe5ce872c5713766f5b2c2df1d26d

  • SHA1

    41195e9723c97386fcf222a992e9b814f2715d1e

  • SHA256

    10bca2a88b6fa182aac5f7423fa25c80f40fe37f5b697d5a7df48b0f597f0291

  • SHA512

    e4f38286f09f32e8a1b63ef28af0239bbfc4a31f1aeb2bff6b25f8b729121fc36f09cdbc18e219b70459a0976ee790259ca3f10a9e43fb7f37d655154a4cf4d7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10bca2a88b6fa182aac5f7423fa25c80f40fe37f5b697d5a7df48b0f597f0291

    • Size

      99KB

    • MD5

      7d1fe5ce872c5713766f5b2c2df1d26d

    • SHA1

      41195e9723c97386fcf222a992e9b814f2715d1e

    • SHA256

      10bca2a88b6fa182aac5f7423fa25c80f40fe37f5b697d5a7df48b0f597f0291

    • SHA512

      e4f38286f09f32e8a1b63ef28af0239bbfc4a31f1aeb2bff6b25f8b729121fc36f09cdbc18e219b70459a0976ee790259ca3f10a9e43fb7f37d655154a4cf4d7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks