Overview

overview

10

Static

static

10

7352658958...59.exe

windows7-x64

10

7352658958...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73526589581b2455a7fbee2deea4d159

  • Size

    517KB

  • Sample

    231219-wsla6abcan

  • MD5

    73526589581b2455a7fbee2deea4d159

  • SHA1

    ac3cd9b2f6c1d3e2061455ae0bbbd9168463a26f

  • SHA256

    b23919cbd230fb0c8e79ccfa9fea3710187b773b546be657770fb5f99874b915

  • SHA512

    dcfe757cb3143a563e5b0e8d4bec35c65944e868749c0e5129aa54cae5368094bf633e6627a01091056850cb1065f7bfeabc6c8879a4eb022502b6376fd66df0

  • SSDEEP

    12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csVej:g4+wlYBsb3zNsm

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      73526589581b2455a7fbee2deea4d159

    • Size

      517KB

    • MD5

      73526589581b2455a7fbee2deea4d159

    • SHA1

      ac3cd9b2f6c1d3e2061455ae0bbbd9168463a26f

    • SHA256

      b23919cbd230fb0c8e79ccfa9fea3710187b773b546be657770fb5f99874b915

    • SHA512

      dcfe757cb3143a563e5b0e8d4bec35c65944e868749c0e5129aa54cae5368094bf633e6627a01091056850cb1065f7bfeabc6c8879a4eb022502b6376fd66df0

    • SSDEEP

      12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csVej:g4+wlYBsb3zNsm

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks