Overview

overview

10

Static

static

10

10afa2f83f...91.exe

windows7_x64

10

10afa2f83f...91.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10afa2f83f36d61d974a647f31f0fdc0c07d10236c9f49905f8c5e12bd10db91

  • Size

    216KB

  • Sample

    220212-gw6c6sghc3

  • MD5

    b35358f26964918c18fbea4ca4c87ba2

  • SHA1

    573fd2586a2762d08a6a884c0becbbc003802aac

  • SHA256

    10afa2f83f36d61d974a647f31f0fdc0c07d10236c9f49905f8c5e12bd10db91

  • SHA512

    2dae6ae1ac5e138abb808e9c0c6f70cc35ebbf15f49f3488f66ef04d4371562b65ea9f824b2d4f6c3cf51e65fe7bb0679133cf893f2dd6156f7ac8d6dbf2973c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10afa2f83f36d61d974a647f31f0fdc0c07d10236c9f49905f8c5e12bd10db91

    • Size

      216KB

    • MD5

      b35358f26964918c18fbea4ca4c87ba2

    • SHA1

      573fd2586a2762d08a6a884c0becbbc003802aac

    • SHA256

      10afa2f83f36d61d974a647f31f0fdc0c07d10236c9f49905f8c5e12bd10db91

    • SHA512

      2dae6ae1ac5e138abb808e9c0c6f70cc35ebbf15f49f3488f66ef04d4371562b65ea9f824b2d4f6c3cf51e65fe7bb0679133cf893f2dd6156f7ac8d6dbf2973c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks