Overview

overview

10

Static

static

069e112b1d...5f.exe

windows7_x64

10

069e112b1d...5f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    069e112b1d7892e0027a7bab7b70bf85866ade793a37ab1b2e8bb584d58f455f

  • Size

    36KB

  • Sample

    220212-mprt4achgr

  • MD5

    17f440c908d24b35abecadfb6fa4a6fe

  • SHA1

    76775e97fbe2f7a3da6c713b332d6546cd4b708c

  • SHA256

    069e112b1d7892e0027a7bab7b70bf85866ade793a37ab1b2e8bb584d58f455f

  • SHA512

    52eb5d581f4c388b1b0f9e222032b74b24a2d432c89a5d199eae560c0ca1c8be32837e26823a75995b3d04e6a70a4a226220d1cb2bb3f7a4fb726272a8ef71c5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      069e112b1d7892e0027a7bab7b70bf85866ade793a37ab1b2e8bb584d58f455f

    • Size

      36KB

    • MD5

      17f440c908d24b35abecadfb6fa4a6fe

    • SHA1

      76775e97fbe2f7a3da6c713b332d6546cd4b708c

    • SHA256

      069e112b1d7892e0027a7bab7b70bf85866ade793a37ab1b2e8bb584d58f455f

    • SHA512

      52eb5d581f4c388b1b0f9e222032b74b24a2d432c89a5d199eae560c0ca1c8be32837e26823a75995b3d04e6a70a4a226220d1cb2bb3f7a4fb726272a8ef71c5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks