Overview

overview

10

Static

static

108e986f82...95.exe

windows7_x64

10

108e986f82...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    108e986f825a919794a11c9cdf5a52ecfdb2a1eae7c2a946a13c8a728886ea95

  • Size

    58KB

  • Sample

    220212-gyvdpaghd9

  • MD5

    a71011acda399f90eb8f919e67be19e5

  • SHA1

    ebaca63510c2eb609fac9484ac4331dfce275392

  • SHA256

    108e986f825a919794a11c9cdf5a52ecfdb2a1eae7c2a946a13c8a728886ea95

  • SHA512

    692daaa97b910d0230fce66c654b510b3b99939bcad1ed525a7e9ab27afaff5017686b36bcef4d4e284e357fa18b599c7aec7d47fd4186c61ea40241b5041a6f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      108e986f825a919794a11c9cdf5a52ecfdb2a1eae7c2a946a13c8a728886ea95

    • Size

      58KB

    • MD5

      a71011acda399f90eb8f919e67be19e5

    • SHA1

      ebaca63510c2eb609fac9484ac4331dfce275392

    • SHA256

      108e986f825a919794a11c9cdf5a52ecfdb2a1eae7c2a946a13c8a728886ea95

    • SHA512

      692daaa97b910d0230fce66c654b510b3b99939bcad1ed525a7e9ab27afaff5017686b36bcef4d4e284e357fa18b599c7aec7d47fd4186c61ea40241b5041a6f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks