Overview

overview

10

Static

static

3

a32411c9e8...62.exe

windows7-x64

10

a32411c9e8...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a32411c9e8f3e101365364554eb2eb62

  • Size

    36KB

  • Sample

    231219-z7lf9ahbf7

  • MD5

    a32411c9e8f3e101365364554eb2eb62

  • SHA1

    0d8f025bea1d34e21bf6b332dc21b38f6582ed0a

  • SHA256

    d75d8a20a6edc5ec261afab70ebb29e941f8d6d0f10e3db7ec77d17da620d381

  • SHA512

    f0532cd046a9579de2c43b12fad075efc5d7c9308a7d4a9e851f10b9e2af3952d4ab53156d0f3d35e379c0a65a1c5d9b46058003f3fb809b18136cf15439665a

  • SSDEEP

    768:H1xwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv26S7Dg:nwbYP4nuEApQK4TQbtY2gA9DX+ytBO0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      a32411c9e8f3e101365364554eb2eb62

    • Size

      36KB

    • MD5

      a32411c9e8f3e101365364554eb2eb62

    • SHA1

      0d8f025bea1d34e21bf6b332dc21b38f6582ed0a

    • SHA256

      d75d8a20a6edc5ec261afab70ebb29e941f8d6d0f10e3db7ec77d17da620d381

    • SHA512

      f0532cd046a9579de2c43b12fad075efc5d7c9308a7d4a9e851f10b9e2af3952d4ab53156d0f3d35e379c0a65a1c5d9b46058003f3fb809b18136cf15439665a

    • SSDEEP

      768:H1xwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv26S7Dg:nwbYP4nuEApQK4TQbtY2gA9DX+ytBO0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks