Overview

overview

10

Static

static

3

41a903cd91...0N.exe

windows7-x64

10

41a903cd91...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41a903cd91b9ab7c54404289d3962a60N.exe

  • Size

    35KB

  • Sample

    240823-rwlc4szbqd

  • MD5

    41a903cd91b9ab7c54404289d3962a60

  • SHA1

    b56d81f2fe473647fb9c2866718a4cd82b08baa7

  • SHA256

    93209f92e77a2a71a365b908b16e5a388270841d796ef8306a136fc951bab611

  • SHA512

    24def65b9aabd7ad152eafd0b3de19cbf87c8810e7721e08df91f14593ce22aa8263916bbeab6eb6451d1f4b251ba435a2e41875644f140a127a4563efc914fe

  • SSDEEP

    768:qwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Du:qwbYP4nuEApQK4TQbtY2gA9DX+ytBO0

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      41a903cd91b9ab7c54404289d3962a60N.exe

    • Size

      35KB

    • MD5

      41a903cd91b9ab7c54404289d3962a60

    • SHA1

      b56d81f2fe473647fb9c2866718a4cd82b08baa7

    • SHA256

      93209f92e77a2a71a365b908b16e5a388270841d796ef8306a136fc951bab611

    • SHA512

      24def65b9aabd7ad152eafd0b3de19cbf87c8810e7721e08df91f14593ce22aa8263916bbeab6eb6451d1f4b251ba435a2e41875644f140a127a4563efc914fe

    • SSDEEP

      768:qwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Du:qwbYP4nuEApQK4TQbtY2gA9DX+ytBO0

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks