Overview

overview

10

Static

static

10

2c43bc2636...9c.exe

windows7-x64

10

2c43bc2636...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c43bc2636af763584c23e31fd1a374b162933b11ed22d6773593896094c1d9c

  • Size

    88KB

  • Sample

    221012-tes3qsade9

  • MD5

    948460a9dc9709045e0e325af9753d44

  • SHA1

    b7fc8420a98ca85b91a0f08ba99bbe835fd8b940

  • SHA256

    2c43bc2636af763584c23e31fd1a374b162933b11ed22d6773593896094c1d9c

  • SHA512

    b6d9a6c8617b574f2ae7dea590b08c6653b5bf38998c0614da86aef81da08cb7e5bc5318be8424cf91c6063db24fed2145af5af399af0bab395f198f5f5e4be5

  • SSDEEP

    1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro1PTEzj:y0hpgz6xGhTjwHN30BE1bE3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      2c43bc2636af763584c23e31fd1a374b162933b11ed22d6773593896094c1d9c

    • Size

      88KB

    • MD5

      948460a9dc9709045e0e325af9753d44

    • SHA1

      b7fc8420a98ca85b91a0f08ba99bbe835fd8b940

    • SHA256

      2c43bc2636af763584c23e31fd1a374b162933b11ed22d6773593896094c1d9c

    • SHA512

      b6d9a6c8617b574f2ae7dea590b08c6653b5bf38998c0614da86aef81da08cb7e5bc5318be8424cf91c6063db24fed2145af5af399af0bab395f198f5f5e4be5

    • SSDEEP

      1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro1PTEzj:y0hpgz6xGhTjwHN30BE1bE3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks