Overview

overview

10

Static

static

10

01657fed88...3b.exe

windows7_x64

10

01657fed88...3b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01657fed88c7c6402a7df3a60d1b5df8664729c2ccf412f2d942e47ceda9ba3b

  • Size

    216KB

  • Sample

    220212-pnt9yaccd7

  • MD5

    3acb524a1ff787e7bd45a1b0158d8e90

  • SHA1

    364a181e4bb74e5f4898137dd23bfe9ec83d1dd4

  • SHA256

    01657fed88c7c6402a7df3a60d1b5df8664729c2ccf412f2d942e47ceda9ba3b

  • SHA512

    fc2181047e14aa8041338a6ff909beb022ba39d0454e59d2d3af096204ee1a10128b582003f1ce06fc2b10f5cd4846947c640b62ddf163a144f52d6826a24e41

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      01657fed88c7c6402a7df3a60d1b5df8664729c2ccf412f2d942e47ceda9ba3b

    • Size

      216KB

    • MD5

      3acb524a1ff787e7bd45a1b0158d8e90

    • SHA1

      364a181e4bb74e5f4898137dd23bfe9ec83d1dd4

    • SHA256

      01657fed88c7c6402a7df3a60d1b5df8664729c2ccf412f2d942e47ceda9ba3b

    • SHA512

      fc2181047e14aa8041338a6ff909beb022ba39d0454e59d2d3af096204ee1a10128b582003f1ce06fc2b10f5cd4846947c640b62ddf163a144f52d6826a24e41

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks