Overview

overview

10

Static

static

10

108d985e76...04.exe

windows7_x64

10

108d985e76...04.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    108d985e76108b54c209f3316a1467b20fbbda4f08ed64a476f0936249f9bb04

  • Size

    152KB

  • Sample

    220212-gy24jaghe4

  • MD5

    3c3789eced96e78028d7711bf72088d1

  • SHA1

    ae3015db97927282659aa2a60e3a235f95f646fc

  • SHA256

    108d985e76108b54c209f3316a1467b20fbbda4f08ed64a476f0936249f9bb04

  • SHA512

    537c42273b9e638108760c2aea559630a97c8641dbeb194e9415b8958c192b43106ecc45f19c5c9a167979990fb51a9edcfb65946f6e4b94ff93b48a67eaf60c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      108d985e76108b54c209f3316a1467b20fbbda4f08ed64a476f0936249f9bb04

    • Size

      152KB

    • MD5

      3c3789eced96e78028d7711bf72088d1

    • SHA1

      ae3015db97927282659aa2a60e3a235f95f646fc

    • SHA256

      108d985e76108b54c209f3316a1467b20fbbda4f08ed64a476f0936249f9bb04

    • SHA512

      537c42273b9e638108760c2aea559630a97c8641dbeb194e9415b8958c192b43106ecc45f19c5c9a167979990fb51a9edcfb65946f6e4b94ff93b48a67eaf60c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks