Overview

overview

10

Static

static

10

048d88ec4a...43.exe

windows7_x64

10

048d88ec4a...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    048d88ec4a11ef316f3a5a951db037c459a4aed4231133d98685030db33ac143

  • Size

    101KB

  • Sample

    220212-ngwnrabfh3

  • MD5

    bfb6af0c5cc8fd9a1c6fd4b3d0c13b58

  • SHA1

    211258e12dcad14f46c3dd9b0deb0aeb04edcf10

  • SHA256

    048d88ec4a11ef316f3a5a951db037c459a4aed4231133d98685030db33ac143

  • SHA512

    f0c14c8f4975471624070e0a98067b48e731af953513c22c37479b822b921e16edb8affacadec7126e6f7221c02542fb55568deec0349da34a5c94b805f35f4d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      048d88ec4a11ef316f3a5a951db037c459a4aed4231133d98685030db33ac143

    • Size

      101KB

    • MD5

      bfb6af0c5cc8fd9a1c6fd4b3d0c13b58

    • SHA1

      211258e12dcad14f46c3dd9b0deb0aeb04edcf10

    • SHA256

      048d88ec4a11ef316f3a5a951db037c459a4aed4231133d98685030db33ac143

    • SHA512

      f0c14c8f4975471624070e0a98067b48e731af953513c22c37479b822b921e16edb8affacadec7126e6f7221c02542fb55568deec0349da34a5c94b805f35f4d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks