Overview

overview

10

Static

static

10

76cd423ca0...27.exe

windows7-x64

10

76cd423ca0...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76cd423ca010107efe0014d35d7c7f2a0f017ebfb0a43359ba7729bfb60a7527

  • Size

    100KB

  • Sample

    240410-3dzcsseb44

  • MD5

    37a44fbce575abae7de444526d4a9557

  • SHA1

    09451ccdbff9d83e89f0a043ae6f1b540c180c0d

  • SHA256

    76cd423ca010107efe0014d35d7c7f2a0f017ebfb0a43359ba7729bfb60a7527

  • SHA512

    5dcf9b4b97b098338ea61b76d89f58ce887bd8274b7478a91594942b8d5161500944090261a7b092c5f4a1ab8877d9edf29958b0a54d4c38310e55fac55f2904

  • SSDEEP

    1536:Zoaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrJxC:K0hpgz6xGhZamyF30BNxC

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      76cd423ca010107efe0014d35d7c7f2a0f017ebfb0a43359ba7729bfb60a7527

    • Size

      100KB

    • MD5

      37a44fbce575abae7de444526d4a9557

    • SHA1

      09451ccdbff9d83e89f0a043ae6f1b540c180c0d

    • SHA256

      76cd423ca010107efe0014d35d7c7f2a0f017ebfb0a43359ba7729bfb60a7527

    • SHA512

      5dcf9b4b97b098338ea61b76d89f58ce887bd8274b7478a91594942b8d5161500944090261a7b092c5f4a1ab8877d9edf29958b0a54d4c38310e55fac55f2904

    • SSDEEP

      1536:Zoaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrJxC:K0hpgz6xGhZamyF30BNxC

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Detects executables built or packed with MPress PE compressor

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks