Overview

overview

10

Static

static

10

04396c7638...e2.exe

windows7_x64

10

04396c7638...e2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2

  • Size

    99KB

  • Sample

    220212-nmd1wsddgp

  • MD5

    376550eb42d7c55e1442e12b10f25e36

  • SHA1

    6df93d7db01a59e1adfe5cd2c8f5464389c10c6c

  • SHA256

    04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2

  • SHA512

    553d7c228bfbd8b4b384cb5a323b004d3543197b4c5200e1a3d8b4c326a3abcf9de494d02eb8f63952ba59a172f4d2112471bd02bf75ec964920ce0c271fa139

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2

    • Size

      99KB

    • MD5

      376550eb42d7c55e1442e12b10f25e36

    • SHA1

      6df93d7db01a59e1adfe5cd2c8f5464389c10c6c

    • SHA256

      04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2

    • SHA512

      553d7c228bfbd8b4b384cb5a323b004d3543197b4c5200e1a3d8b4c326a3abcf9de494d02eb8f63952ba59a172f4d2112471bd02bf75ec964920ce0c271fa139

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks