Overview

overview

10

Static

static

10

0414543f35...b1.exe

windows7_x64

10

0414543f35...b1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0414543f354bbc1dcb038aac11dd0381c32854f83b2d9d264c60def5fe12eeb1

  • Size

    79KB

  • Sample

    220212-npa21sbge6

  • MD5

    920931b93744b0b075cc02dfd391e26f

  • SHA1

    b7942154b8f484c3b27d1223a1e930822cbd218b

  • SHA256

    0414543f354bbc1dcb038aac11dd0381c32854f83b2d9d264c60def5fe12eeb1

  • SHA512

    5724bbbed22acf5c017513a8afeae22783768157e0cace36cfff739047c291dbe2764bf77dd879bd9af13e38722c9dfaba6864f1797b835aefb994ec7a623a8a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0414543f354bbc1dcb038aac11dd0381c32854f83b2d9d264c60def5fe12eeb1

    • Size

      79KB

    • MD5

      920931b93744b0b075cc02dfd391e26f

    • SHA1

      b7942154b8f484c3b27d1223a1e930822cbd218b

    • SHA256

      0414543f354bbc1dcb038aac11dd0381c32854f83b2d9d264c60def5fe12eeb1

    • SHA512

      5724bbbed22acf5c017513a8afeae22783768157e0cace36cfff739047c291dbe2764bf77dd879bd9af13e38722c9dfaba6864f1797b835aefb994ec7a623a8a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks