General

  • Target

    00252dc7823e72b135ea3eecbcc28f3a967215b763a999c76483d428b34bac9c

  • Size

    101KB

  • Sample

    220212-p3vt1secbq

  • MD5

    ba330b83a2b686675052bae94d56bdb8

  • SHA1

    cc41dc18f988bc69d9e7421667c338a9935024d2

  • SHA256

    00252dc7823e72b135ea3eecbcc28f3a967215b763a999c76483d428b34bac9c

  • SHA512

    1467d4b658793df49af95b031bfbe6551e200a77d9e4122e2ef3ac1bb37ae090ba81fea5b6e1375627c6e230d9cdf95ad6eb07cef8617048a9ff8d8891e4c760

Malware Config

Targets

    • Target

      00252dc7823e72b135ea3eecbcc28f3a967215b763a999c76483d428b34bac9c

    • Size

      101KB

    • MD5

      ba330b83a2b686675052bae94d56bdb8

    • SHA1

      cc41dc18f988bc69d9e7421667c338a9935024d2

    • SHA256

      00252dc7823e72b135ea3eecbcc28f3a967215b763a999c76483d428b34bac9c

    • SHA512

      1467d4b658793df49af95b031bfbe6551e200a77d9e4122e2ef3ac1bb37ae090ba81fea5b6e1375627c6e230d9cdf95ad6eb07cef8617048a9ff8d8891e4c760

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks