Resubmissions

24-02-2022 11:08

220224-m8nlsachc3 10

30-09-2021 12:27

210930-pmrseshfg9 8

General

  • Target

    fb9634f7f285e1b11b44d55c58f0c2e8d14fa5ace58670d8c806b09d6570c629

  • Size

    216KB

  • Sample

    220224-m8nlsachc3

  • MD5

    052e970aff7e2e0e3209417a92f4e2c6

  • SHA1

    32c0cb93f35e65295a02d362c3bf4fd71fa9365c

  • SHA256

    fb9634f7f285e1b11b44d55c58f0c2e8d14fa5ace58670d8c806b09d6570c629

  • SHA512

    38d19aea666d07db8c2f2925d3d7af99d03936cfda936fbc994d00ce66b27147647ca28bae684b99fdbbc7e424b34b13c5c5a6d4739d4a46934ae2ba744e8c8d

Malware Config

Targets

    • Target

      fb9634f7f285e1b11b44d55c58f0c2e8d14fa5ace58670d8c806b09d6570c629

    • Size

      216KB

    • MD5

      052e970aff7e2e0e3209417a92f4e2c6

    • SHA1

      32c0cb93f35e65295a02d362c3bf4fd71fa9365c

    • SHA256

      fb9634f7f285e1b11b44d55c58f0c2e8d14fa5ace58670d8c806b09d6570c629

    • SHA512

      38d19aea666d07db8c2f2925d3d7af99d03936cfda936fbc994d00ce66b27147647ca28bae684b99fdbbc7e424b34b13c5c5a6d4739d4a46934ae2ba744e8c8d

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks