Overview

overview

10

Static

static

10

5c7f8b81d0...7f.exe

windows7-x64

10

5c7f8b81d0...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f

  • Size

    92KB

  • Sample

    241108-25pf8ssblk

  • MD5

    5237e96881dc205e761b920550a3ae0f

  • SHA1

    1a2eba62f37ffacf0311d0b8d535526c90254c21

  • SHA256

    5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f

  • SHA512

    82079d87e00ebfd9fd7a81b10a838726ba06323dfea95ba008393a961a3770a1ba857fa867f4a9ce40bd36426053895980929dc41050e9232a7667f2b9d1b15d

  • SSDEEP

    1536:R7M3BhP/E9y9f/zMGv/4P6bR1ik5J/lEuU0Ay2s+eHxCEtkz30rtrs:O3BN+IfRO6bRnlZAvHcxCEtg30Bw

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f

    • Size

      92KB

    • MD5

      5237e96881dc205e761b920550a3ae0f

    • SHA1

      1a2eba62f37ffacf0311d0b8d535526c90254c21

    • SHA256

      5c7f8b81d0678a3d9621b004b296602dde72934fea4bc7544e4d22400e2ab37f

    • SHA512

      82079d87e00ebfd9fd7a81b10a838726ba06323dfea95ba008393a961a3770a1ba857fa867f4a9ce40bd36426053895980929dc41050e9232a7667f2b9d1b15d

    • SSDEEP

      1536:R7M3BhP/E9y9f/zMGv/4P6bR1ik5J/lEuU0Ay2s+eHxCEtkz30rtrs:O3BN+IfRO6bRnlZAvHcxCEtg30Bw

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks