Overview

overview

10

Static

static

10

10b50ee20b...52.exe

windows7_x64

10

10b50ee20b...52.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10b50ee20ba49b1c2f338fc0948f86671a54dd253d726fc2a61ace95f436db52

  • Size

    192KB

  • Sample

    220212-gwtz5sadhn

  • MD5

    a0ad948f08ee36054975ade27cc5ffa0

  • SHA1

    db40b47618355e0cfc5cbfd67bcdae947ad5e49f

  • SHA256

    10b50ee20ba49b1c2f338fc0948f86671a54dd253d726fc2a61ace95f436db52

  • SHA512

    262ea8d1c7c115c8e170822b2722ca01eab334371bfa9906c22f8595631f89075901922dd8064a9209cc4e97238211c494a8eedb20f4a8c68579b3c397d442de

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10b50ee20ba49b1c2f338fc0948f86671a54dd253d726fc2a61ace95f436db52

    • Size

      192KB

    • MD5

      a0ad948f08ee36054975ade27cc5ffa0

    • SHA1

      db40b47618355e0cfc5cbfd67bcdae947ad5e49f

    • SHA256

      10b50ee20ba49b1c2f338fc0948f86671a54dd253d726fc2a61ace95f436db52

    • SHA512

      262ea8d1c7c115c8e170822b2722ca01eab334371bfa9906c22f8595631f89075901922dd8064a9209cc4e97238211c494a8eedb20f4a8c68579b3c397d442de

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks