Overview

overview

10

Static

static

10

4a36db597e...18.exe

windows7-x64

10

4a36db597e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a36db597e851f794634226fc98852f8_JaffaCakes118

  • Size

    4.5MB

  • Sample

    241015-1xf98azamb

  • MD5

    4a36db597e851f794634226fc98852f8

  • SHA1

    dd7b9f7f12e7f522845fedd12da1a27b997df1eb

  • SHA256

    2f7aac2dccff2dbe2985a739d8c8b14fd5a0283a841257c26d30266b6077466e

  • SHA512

    7137c832c1fa4aeff6b56ef7ec93e06b6e74ffd40c276edd03c313a8a7b4adc5074d0d9744b91205e73e18225c777541f5b20770f63f6e45fa531b4d1ad29f50

  • SSDEEP

    24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYn:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYn

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      4a36db597e851f794634226fc98852f8_JaffaCakes118

    • Size

      4.5MB

    • MD5

      4a36db597e851f794634226fc98852f8

    • SHA1

      dd7b9f7f12e7f522845fedd12da1a27b997df1eb

    • SHA256

      2f7aac2dccff2dbe2985a739d8c8b14fd5a0283a841257c26d30266b6077466e

    • SHA512

      7137c832c1fa4aeff6b56ef7ec93e06b6e74ffd40c276edd03c313a8a7b4adc5074d0d9744b91205e73e18225c777541f5b20770f63f6e45fa531b4d1ad29f50

    • SSDEEP

      24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYn:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYn

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks