Overview

overview

10

Static

static

10

022f445623...dN.exe

windows7-x64

10

022f445623...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    022f445623c90648a525a645fdf262bbad53c6da1daac5cf8ec3c105d8bdf9bdN

  • Size

    92KB

  • Sample

    241003-jknebsscpp

  • MD5

    c0fe962142d7fd49a860e678172975e0

  • SHA1

    0ca86795b5ff7cfefb71aeec96559645d0c8e93f

  • SHA256

    022f445623c90648a525a645fdf262bbad53c6da1daac5cf8ec3c105d8bdf9bd

  • SHA512

    f308193b8dc6defdb76b6ed92ebe57f51d817e8ffc8ece8f6875eca454e38dc7991dfa355a3d4ea5f3a83273cb6079d0452dd18b06272ddad90b99fb1bfd4cd0

  • SSDEEP

    1536:R7M3BhP/E9y9f/zMGv/4P6bR1ik5J/lEuU0Ay2s+eHxCEtkz30rtrq:O3BN+IfRO6bRnlZAvHcxCEtg30B2

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      022f445623c90648a525a645fdf262bbad53c6da1daac5cf8ec3c105d8bdf9bdN

    • Size

      92KB

    • MD5

      c0fe962142d7fd49a860e678172975e0

    • SHA1

      0ca86795b5ff7cfefb71aeec96559645d0c8e93f

    • SHA256

      022f445623c90648a525a645fdf262bbad53c6da1daac5cf8ec3c105d8bdf9bd

    • SHA512

      f308193b8dc6defdb76b6ed92ebe57f51d817e8ffc8ece8f6875eca454e38dc7991dfa355a3d4ea5f3a83273cb6079d0452dd18b06272ddad90b99fb1bfd4cd0

    • SSDEEP

      1536:R7M3BhP/E9y9f/zMGv/4P6bR1ik5J/lEuU0Ay2s+eHxCEtkz30rtrq:O3BN+IfRO6bRnlZAvHcxCEtg30B2

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks