Overview

overview

10

Static

static

10

b4da05f863...9a.exe

windows7-x64

10

b4da05f863...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4da05f8631e42d6b08baac098bd479a

  • Size

    392KB

  • Sample

    231220-p3qv3afbc5

  • MD5

    b4da05f8631e42d6b08baac098bd479a

  • SHA1

    81a0bcfb22667df52f634fe6655a908a39aee63a

  • SHA256

    0707d325cb1e155c64da6250105089ba37e867b75109e4e5a59789936a7f39a4

  • SHA512

    b899d3ac5df07401760522432ce2e5e951b923c605d0ede77437682870f784dbab540d5fab2431c8491f8c7b0f5570f053edd6fff862ca18e1412e3ec1a718d4

  • SSDEEP

    6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5l:0RfQn+w8EYiBlMkn5f9J105s

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      b4da05f8631e42d6b08baac098bd479a

    • Size

      392KB

    • MD5

      b4da05f8631e42d6b08baac098bd479a

    • SHA1

      81a0bcfb22667df52f634fe6655a908a39aee63a

    • SHA256

      0707d325cb1e155c64da6250105089ba37e867b75109e4e5a59789936a7f39a4

    • SHA512

      b899d3ac5df07401760522432ce2e5e951b923c605d0ede77437682870f784dbab540d5fab2431c8491f8c7b0f5570f053edd6fff862ca18e1412e3ec1a718d4

    • SSDEEP

      6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5l:0RfQn+w8EYiBlMkn5f9J105s

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks