General

  • Target

    0029e612e154b74aaa1ec78aeadbd2d7ac661f8db931ce022148d216460d04cd

  • Size

    58KB

  • Sample

    220212-p3nqpsecbn

  • MD5

    660edab1b99d11ee2c0cc536ea9e2b67

  • SHA1

    b85f998891f802702134aaa6f236def57a5212cb

  • SHA256

    0029e612e154b74aaa1ec78aeadbd2d7ac661f8db931ce022148d216460d04cd

  • SHA512

    676754d0de2660290c11fd87c9ea7b9257debcc2ea789f1f463fd389850c8824a8d37668afaa68e8868d464e67345d1406cccaad50d83bc7d8cae543e6b06b5a

Malware Config

Targets

    • Target

      0029e612e154b74aaa1ec78aeadbd2d7ac661f8db931ce022148d216460d04cd

    • Size

      58KB

    • MD5

      660edab1b99d11ee2c0cc536ea9e2b67

    • SHA1

      b85f998891f802702134aaa6f236def57a5212cb

    • SHA256

      0029e612e154b74aaa1ec78aeadbd2d7ac661f8db931ce022148d216460d04cd

    • SHA512

      676754d0de2660290c11fd87c9ea7b9257debcc2ea789f1f463fd389850c8824a8d37668afaa68e8868d464e67345d1406cccaad50d83bc7d8cae543e6b06b5a

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks