sakula | 0a44a80418157f1926dce2fcbff5f55dbc35eba77ff09050e3cb803a220b5005 | Triage

Sharing

General

Target

0a44a80418157f1926dce2fcbff5f55dbc35eba77ff09050e3cb803a220b5005
Size

35KB
Sample

220212-lb2lpsaee5
MD5

376996757760dae9ae0eea399a27e302
SHA1

abb202d6645f48a5806ccba0e32070f85556e62a
SHA256

0a44a80418157f1926dce2fcbff5f55dbc35eba77ff09050e3cb803a220b5005
SHA512

9bb4f34e7aa5b4c4109608343f411035cf8c87175dca96ffbe33ad7536c1a905fb15b36562ab3a951d028805290135251e69ab5a7e15407480bc712ead3ed224

Score

10^/10

sakula persistence rat trojan

Malware Config

Targets

- Target
  
  0a44a80418157f1926dce2fcbff5f55dbc35eba77ff09050e3cb803a220b5005
- Size
  
  35KB
- MD5
  
  376996757760dae9ae0eea399a27e302
- SHA1
  
  abb202d6645f48a5806ccba0e32070f85556e62a
- SHA256
  
  0a44a80418157f1926dce2fcbff5f55dbc35eba77ff09050e3cb803a220b5005
- SHA512
  
  9bb4f34e7aa5b4c4109608343f411035cf8c87175dca96ffbe33ad7536c1a905fb15b36562ab3a951d028805290135251e69ab5a7e15407480bc712ead3ed224
Score

10^/10

sakula persistence rat trojan
- Sakula
  Sakula is a remote access trojan with various capabilities.
  trojan rat sakula
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

sakulapersistencerattrojan

behavioral2

sakulapersistencerattrojan