sakula | 1e25c53401f55f30d4103443c939ddaa2c92ed661b8a133f758eeb4f5b7741e3 | Triage

Sharing

General

Target

1e25c53401f55f30d4103443c939ddaa2c92ed661b8a133f758eeb4f5b7741e3N
Size

79KB
Sample

241104-rf7w6s1eqm
MD5

f9012e1d3b750fb88e966316fc0dde70
SHA1

d8bdf5219c5c6340e2cc4df5a2e5bff9b701760c
SHA256

1e25c53401f55f30d4103443c939ddaa2c92ed661b8a133f758eeb4f5b7741e3
SHA512

b6d4623e365031ca5a4bcc8ab071f772c4e6931cf9344ede96667fcc6f2aa73a7ca571411ea60b4f7935395c2e3a75d6d68cd00a0871e26ccaaddfca30ad9af2
SSDEEP

1536:1oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro6:W0hpgz6xGhTjwHN30BE6

Score

10^/10

sakula discovery persistence rat trojan

Malware Config

Targets

- Target
  
  1e25c53401f55f30d4103443c939ddaa2c92ed661b8a133f758eeb4f5b7741e3N
- Size
  
  79KB
- MD5
  
  f9012e1d3b750fb88e966316fc0dde70
- SHA1
  
  d8bdf5219c5c6340e2cc4df5a2e5bff9b701760c
- SHA256
  
  1e25c53401f55f30d4103443c939ddaa2c92ed661b8a133f758eeb4f5b7741e3
- SHA512
  
  b6d4623e365031ca5a4bcc8ab071f772c4e6931cf9344ede96667fcc6f2aa73a7ca571411ea60b4f7935395c2e3a75d6d68cd00a0871e26ccaaddfca30ad9af2
- SSDEEP
  
  1536:1oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro6:W0hpgz6xGhTjwHN30BE6
Score

10^/10

sakula discovery persistence rat trojan
- Sakula
  Sakula is a remote access trojan with various capabilities.
  trojan rat sakula
- Sakula family
  sakula
- Sakula payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

sakuladiscoverypersistencerattrojan

behavioral2

sakuladiscoverypersistencerattrojan