Overview

overview

10

Static

static

10926fb33a...96.exe

windows7_x64

10

10926fb33a...96.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10926fb33af6a4bc7caa3d2ece115ed7e1ebd120640ea5058a44f92f9167b796

  • Size

    35KB

  • Sample

    220212-gylfsaghd6

  • MD5

    8e166b4d47fea3a09ed71c2c54f79673

  • SHA1

    1c6dc324ba8b20d77a91ac2d78e568eb2c276a6b

  • SHA256

    10926fb33af6a4bc7caa3d2ece115ed7e1ebd120640ea5058a44f92f9167b796

  • SHA512

    f9ac9b7598df707732ca8ea644144f8846e6cfbcb00ef76eba98c8a133b5d9a1cebfa7018e335aab7e6210f69266cc8c8f5527cd32930026027aaca5818c8e93

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10926fb33af6a4bc7caa3d2ece115ed7e1ebd120640ea5058a44f92f9167b796

    • Size

      35KB

    • MD5

      8e166b4d47fea3a09ed71c2c54f79673

    • SHA1

      1c6dc324ba8b20d77a91ac2d78e568eb2c276a6b

    • SHA256

      10926fb33af6a4bc7caa3d2ece115ed7e1ebd120640ea5058a44f92f9167b796

    • SHA512

      f9ac9b7598df707732ca8ea644144f8846e6cfbcb00ef76eba98c8a133b5d9a1cebfa7018e335aab7e6210f69266cc8c8f5527cd32930026027aaca5818c8e93

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks