Overview

overview

10

Static

static

10

10844dde6c...3c.exe

windows7_x64

10

10844dde6c...3c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10844dde6cc9de85b215e362cfa5666f4e2ca82a289c1cea650fbfdb65a6473c

  • Size

    80KB

  • Sample

    220212-gzm11aaecj

  • MD5

    c59e309ff49934efd19e2c2bc66d66e6

  • SHA1

    285e0ea883c874023b6cfe06ea4675a9e8256cb9

  • SHA256

    10844dde6cc9de85b215e362cfa5666f4e2ca82a289c1cea650fbfdb65a6473c

  • SHA512

    7f22b1e5e9de61b11e1e20f85383da5454ad73eab4ef33eb2a34cbfb0d07042938b731af8c2f62241e6a598ba205653eb739893ec10477446854a40043693cbc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      10844dde6cc9de85b215e362cfa5666f4e2ca82a289c1cea650fbfdb65a6473c

    • Size

      80KB

    • MD5

      c59e309ff49934efd19e2c2bc66d66e6

    • SHA1

      285e0ea883c874023b6cfe06ea4675a9e8256cb9

    • SHA256

      10844dde6cc9de85b215e362cfa5666f4e2ca82a289c1cea650fbfdb65a6473c

    • SHA512

      7f22b1e5e9de61b11e1e20f85383da5454ad73eab4ef33eb2a34cbfb0d07042938b731af8c2f62241e6a598ba205653eb739893ec10477446854a40043693cbc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks