Overview

overview

10

Static

static

092425e1a8...3c.exe

windows7_x64

10

092425e1a8...3c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    092425e1a8899882fef31f2997d0703a0777d049b900a4e260ae4ed33a3e113c

  • Size

    35KB

  • Sample

    220212-lq19gscddj

  • MD5

    7923f2123baf97c333bafc64f2fa84cf

  • SHA1

    dcb4556c3ffb17a60fc084fcb2fd188e598e67c8

  • SHA256

    092425e1a8899882fef31f2997d0703a0777d049b900a4e260ae4ed33a3e113c

  • SHA512

    f1b8e978900b4e6dc901866f300361cba2a1b4474696b0bf4a4fffb08c48cd662a180a925244284c845b3bdd44d5edc9f6917e2ed894bb576f56cf7dfce768ee

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      092425e1a8899882fef31f2997d0703a0777d049b900a4e260ae4ed33a3e113c

    • Size

      35KB

    • MD5

      7923f2123baf97c333bafc64f2fa84cf

    • SHA1

      dcb4556c3ffb17a60fc084fcb2fd188e598e67c8

    • SHA256

      092425e1a8899882fef31f2997d0703a0777d049b900a4e260ae4ed33a3e113c

    • SHA512

      f1b8e978900b4e6dc901866f300361cba2a1b4474696b0bf4a4fffb08c48cd662a180a925244284c845b3bdd44d5edc9f6917e2ed894bb576f56cf7dfce768ee

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks