Overview

overview

10

Static

static

10

318e92e96a...ab.exe

windows7_x64

10

318e92e96a...ab.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    318e92e96af1ead0213df713952f57ea4a082cb3e2647acdf736609bb52daeab

  • Size

    79KB

  • Sample

    220615-q3x5tacbg6

  • MD5

    29a0008bd3dce774c80248b45e440100

  • SHA1

    acb1ea3b152b6f165914673290c0a57cf61e1c8b

  • SHA256

    318e92e96af1ead0213df713952f57ea4a082cb3e2647acdf736609bb52daeab

  • SHA512

    15d036027feadee6f8c806495acebc594ee433e2b8552ec9ab21f0799a152c2922a812c09a726b57e80c02596ab1a4837a4c87f34af82c2e72f3338e78d8af1d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      318e92e96af1ead0213df713952f57ea4a082cb3e2647acdf736609bb52daeab

    • Size

      79KB

    • MD5

      29a0008bd3dce774c80248b45e440100

    • SHA1

      acb1ea3b152b6f165914673290c0a57cf61e1c8b

    • SHA256

      318e92e96af1ead0213df713952f57ea4a082cb3e2647acdf736609bb52daeab

    • SHA512

      15d036027feadee6f8c806495acebc594ee433e2b8552ec9ab21f0799a152c2922a812c09a726b57e80c02596ab1a4837a4c87f34af82c2e72f3338e78d8af1d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks