General
- Target 346e9691d829b0ef9e1bc5d5e8737f80N.exe
- Size 35KB
- Sample240726-vnfpfa1fkn
- SHA256 cbd8fdb1e79c73e654d5c5112796d055ad601c94e2ecef452c443ec76e1a4131
Score
10/10
Malware Config
Targets
-
- Target 346e9691d829b0ef9e1bc5d5e8737f80N.exe
- Size 35KB
- SHA256 cbd8fdb1e79c73e654d5c5112796d055ad601c94e2ecef452c443ec76e1a4131
Score10/10Sakula
Sakula is a remote access trojan with various capabilities.
Sakula payload
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Deletes itself
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1