Overview

overview

10

Static

static

10

1093fb8134...65.exe

windows7_x64

10

1093fb8134...65.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1093fb813436876accbdec43d77874b09ff7682e6b6e9d9a72566b55d09c4c65

  • Size

    191KB

  • Sample

    220212-gyecgaghd4

  • MD5

    94d1b47f4cdfa4785ad8772aa586ff4e

  • SHA1

    2001036aa001d0b6efca09e34517e027caadd104

  • SHA256

    1093fb813436876accbdec43d77874b09ff7682e6b6e9d9a72566b55d09c4c65

  • SHA512

    226264d13284a76c7a85c10cd6482d3784602666df4308e2b84e2a143e0a7fc3331dc9de7ef31242ccb6c53720f8977da0c4da40b9323c98f0db450c050f3ad1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1093fb813436876accbdec43d77874b09ff7682e6b6e9d9a72566b55d09c4c65

    • Size

      191KB

    • MD5

      94d1b47f4cdfa4785ad8772aa586ff4e

    • SHA1

      2001036aa001d0b6efca09e34517e027caadd104

    • SHA256

      1093fb813436876accbdec43d77874b09ff7682e6b6e9d9a72566b55d09c4c65

    • SHA512

      226264d13284a76c7a85c10cd6482d3784602666df4308e2b84e2a143e0a7fc3331dc9de7ef31242ccb6c53720f8977da0c4da40b9323c98f0db450c050f3ad1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks