Overview

overview

10

Static

static

10

041c9a7f34...9c.exe

windows7_x64

10

041c9a7f34...9c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    041c9a7f345f86bacb884dc01fd8cc33f2c01439ff5aa87a3c08d299deea959c

  • Size

    99KB

  • Sample

    220212-nn4ypsbge5

  • MD5

    900536be2d7520819c5dbd6396b20feb

  • SHA1

    39c2e50b36a8b0598ad2fed45806455f52f27b29

  • SHA256

    041c9a7f345f86bacb884dc01fd8cc33f2c01439ff5aa87a3c08d299deea959c

  • SHA512

    960803aacbf62b76f130235d9e7d867edc686ce783d9a29b3d99f6f9fccb40704aa95d632b42cb6593f649d26133559b288960d8f3ab9f341692e796cb2e6c49

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      041c9a7f345f86bacb884dc01fd8cc33f2c01439ff5aa87a3c08d299deea959c

    • Size

      99KB

    • MD5

      900536be2d7520819c5dbd6396b20feb

    • SHA1

      39c2e50b36a8b0598ad2fed45806455f52f27b29

    • SHA256

      041c9a7f345f86bacb884dc01fd8cc33f2c01439ff5aa87a3c08d299deea959c

    • SHA512

      960803aacbf62b76f130235d9e7d867edc686ce783d9a29b3d99f6f9fccb40704aa95d632b42cb6593f649d26133559b288960d8f3ab9f341692e796cb2e6c49

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks