Overview

overview

10

Static

static

10

107cf7da2b...ed.exe

windows7_x64

10

107cf7da2b...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    107cf7da2b1ded6f1d83856a048ec21718062b7e11d58e508a376aab6be2caed

  • Size

    100KB

  • Sample

    220212-gz6s4saecn

  • MD5

    83220c0cee35496c83893a9ff99eadfc

  • SHA1

    c7888a1c62ca973566f14c76c25c7d508d7a5b58

  • SHA256

    107cf7da2b1ded6f1d83856a048ec21718062b7e11d58e508a376aab6be2caed

  • SHA512

    ee16ab75439c0bcdbeaa885a63c45ba1f2cb0b76f7cdaf430c2ffb407111789c4c4050cb895c5769239a072e0c957b5057f72467e20e5ebe7bc5a835fb985456

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      107cf7da2b1ded6f1d83856a048ec21718062b7e11d58e508a376aab6be2caed

    • Size

      100KB

    • MD5

      83220c0cee35496c83893a9ff99eadfc

    • SHA1

      c7888a1c62ca973566f14c76c25c7d508d7a5b58

    • SHA256

      107cf7da2b1ded6f1d83856a048ec21718062b7e11d58e508a376aab6be2caed

    • SHA512

      ee16ab75439c0bcdbeaa885a63c45ba1f2cb0b76f7cdaf430c2ffb407111789c4c4050cb895c5769239a072e0c957b5057f72467e20e5ebe7bc5a835fb985456

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks