Overview

overview

10

Static

static

10

HEUR-Troja...ak.exe

windows7-x64

10

HEUR-Troja...ak.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan.Win32.Zenpak.gen-19d5376a3b2c05ec4a9bad6fc359e15ecfd93478b1760c2ce8e4bd7c050a8f8b

  • Size

    1.8MB

  • Sample

    240229-kgyxbsbe6y

  • MD5

    916864d695751c1100cff61774625777

  • SHA1

    e4d53475fa0d37df054ac0d7d2b6e3df667e066e

  • SHA256

    19d5376a3b2c05ec4a9bad6fc359e15ecfd93478b1760c2ce8e4bd7c050a8f8b

  • SHA512

    5026a5e2a72fffedc1a867f44ae3485a55fab891c22ce94451244d9e0dabc776d6a31f975c7c351884a8f9e6dcf158df0692d0d8f8ba933d262137131c85a341

  • SSDEEP

    24576:vBwlYBsawlYBsawlYBsawlYBsawlYBsawlYBsp:Y

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      HEUR-Trojan.Win32.Zenpak.gen-19d5376a3b2c05ec4a9bad6fc359e15ecfd93478b1760c2ce8e4bd7c050a8f8b

    • Size

      1.8MB

    • MD5

      916864d695751c1100cff61774625777

    • SHA1

      e4d53475fa0d37df054ac0d7d2b6e3df667e066e

    • SHA256

      19d5376a3b2c05ec4a9bad6fc359e15ecfd93478b1760c2ce8e4bd7c050a8f8b

    • SHA512

      5026a5e2a72fffedc1a867f44ae3485a55fab891c22ce94451244d9e0dabc776d6a31f975c7c351884a8f9e6dcf158df0692d0d8f8ba933d262137131c85a341

    • SSDEEP

      24576:vBwlYBsawlYBsawlYBsawlYBsawlYBsawlYBsp:Y

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks