Overview

overview

10

Static

static

10

26aeb4306d...09.exe

windows7_x64

10

26aeb4306d...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26aeb4306d11fe8219e450cd26a8af73a8972e1675486cefb2a56bf2b2d04409

  • Size

    79KB

  • Sample

    220616-jhzdtacaa4

  • MD5

    6623ef6b58ca25808463b629d56e4660

  • SHA1

    a432c50373feb75ab0fb681c9f502a5e49fa43bd

  • SHA256

    26aeb4306d11fe8219e450cd26a8af73a8972e1675486cefb2a56bf2b2d04409

  • SHA512

    ac58292418685528ae87db45f2e44bb92fc8ed61376939038e9ec2f2fd7ef162351564534f12c9dfd2cf203277316facccf53ef7d345c87acb48bca9f6d09fba

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      26aeb4306d11fe8219e450cd26a8af73a8972e1675486cefb2a56bf2b2d04409

    • Size

      79KB

    • MD5

      6623ef6b58ca25808463b629d56e4660

    • SHA1

      a432c50373feb75ab0fb681c9f502a5e49fa43bd

    • SHA256

      26aeb4306d11fe8219e450cd26a8af73a8972e1675486cefb2a56bf2b2d04409

    • SHA512

      ac58292418685528ae87db45f2e44bb92fc8ed61376939038e9ec2f2fd7ef162351564534f12c9dfd2cf203277316facccf53ef7d345c87acb48bca9f6d09fba

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks