Overview

overview

10

Static

static

3

65d4ab7652...fb.exe

windows7-x64

10

65d4ab7652...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65d4ab7652d5f4a306e511f723e336fb

  • Size

    35KB

  • Sample

    231219-vnvhladdc7

  • MD5

    65d4ab7652d5f4a306e511f723e336fb

  • SHA1

    bc25a2ca1acfdd19d7e407e2d6bf527d5068f2a2

  • SHA256

    3495c80437180450e22a75f6931ad3d70ad78ea19b458f961461d7e8e041165b

  • SHA512

    aa07f9a451d471272915c0469fe3419a2143be09de26bb5776c8e42bc161e67e2402494cbe0c21acbe2a590197cce4cceab95bed6e3762f027d5a83861976420

  • SSDEEP

    768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Do:lwbYP4nuEApQK4TQbtY2gA9DX+ytBO6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      65d4ab7652d5f4a306e511f723e336fb

    • Size

      35KB

    • MD5

      65d4ab7652d5f4a306e511f723e336fb

    • SHA1

      bc25a2ca1acfdd19d7e407e2d6bf527d5068f2a2

    • SHA256

      3495c80437180450e22a75f6931ad3d70ad78ea19b458f961461d7e8e041165b

    • SHA512

      aa07f9a451d471272915c0469fe3419a2143be09de26bb5776c8e42bc161e67e2402494cbe0c21acbe2a590197cce4cceab95bed6e3762f027d5a83861976420

    • SSDEEP

      768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Do:lwbYP4nuEApQK4TQbtY2gA9DX+ytBO6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks