Overview

overview

10

Static

static

10

074665acb0...7e.exe

windows7_x64

10

074665acb0...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    074665acb0d591fc0eda5212cedef6b07f803506857bac61a642de14b5eb407e

  • Size

    192KB

  • Sample

    220212-mf51csbbd6

  • MD5

    22be18bd103dfd1d7f848ebe6d16814e

  • SHA1

    8156fc566bdfe8dd1855628af6b3a4b36192844b

  • SHA256

    074665acb0d591fc0eda5212cedef6b07f803506857bac61a642de14b5eb407e

  • SHA512

    5330397c01849492b770f3671ed24c955fd835b1ba18040dcfbb9c292102b97295a8f300ac772cf669397b0376bc62987d2acfbfc04af7578672d5cb49831941

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      074665acb0d591fc0eda5212cedef6b07f803506857bac61a642de14b5eb407e

    • Size

      192KB

    • MD5

      22be18bd103dfd1d7f848ebe6d16814e

    • SHA1

      8156fc566bdfe8dd1855628af6b3a4b36192844b

    • SHA256

      074665acb0d591fc0eda5212cedef6b07f803506857bac61a642de14b5eb407e

    • SHA512

      5330397c01849492b770f3671ed24c955fd835b1ba18040dcfbb9c292102b97295a8f300ac772cf669397b0376bc62987d2acfbfc04af7578672d5cb49831941

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks