Overview

overview

10

Static

static

10

0169e86db2...07.exe

windows7_x64

10

0169e86db2...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

  • Size

    100KB

  • Sample

    220212-pnh7nsccd2

  • MD5

    b7b9ff19b2fbb7502b7f12af20635c02

  • SHA1

    b123fc99cd6899b530938aad1603fa4048c6a754

  • SHA256

    0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

  • SHA512

    b57e02a01bfc061d99ded3e7bf7f6df19e8d39c74fe835349f675707ed456795dff6d10786046bd514a2f9eda3fc4db488b1bc6e946447fa649b4bc9873b55aa

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

    • Size

      100KB

    • MD5

      b7b9ff19b2fbb7502b7f12af20635c02

    • SHA1

      b123fc99cd6899b530938aad1603fa4048c6a754

    • SHA256

      0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

    • SHA512

      b57e02a01bfc061d99ded3e7bf7f6df19e8d39c74fe835349f675707ed456795dff6d10786046bd514a2f9eda3fc4db488b1bc6e946447fa649b4bc9873b55aa

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks