Overview

overview

10

Static

static

3

596dea5297...1e.exe

windows7-x64

10

596dea5297...1e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    596dea529785d7747a3270a717a9a3c167e1f01e.exe

  • Size

    58KB

  • Sample

    241117-wjyj5azlfr

  • MD5

    cc1b7c9eada68beb4ff0f0ba2f066c0e

  • SHA1

    596dea529785d7747a3270a717a9a3c167e1f01e

  • SHA256

    0cbb5e112654c75d39beb00b12f773b7ea44931b6524f8071bdedd91eb7e8efb

  • SHA512

    d5b4ede66ee21b11fd29ff1c714c9ab3b82aa1174082bc078e8d1d037efde85a682c4baccb53c4bf546b3a919ba14429bae972d5dce7023f3eeb53fc96526d64

  • SSDEEP

    1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/Q:iEoIlwIguEA4c5DgA9DOyq0eFI

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      596dea529785d7747a3270a717a9a3c167e1f01e.exe

    • Size

      58KB

    • MD5

      cc1b7c9eada68beb4ff0f0ba2f066c0e

    • SHA1

      596dea529785d7747a3270a717a9a3c167e1f01e

    • SHA256

      0cbb5e112654c75d39beb00b12f773b7ea44931b6524f8071bdedd91eb7e8efb

    • SHA512

      d5b4ede66ee21b11fd29ff1c714c9ab3b82aa1174082bc078e8d1d037efde85a682c4baccb53c4bf546b3a919ba14429bae972d5dce7023f3eeb53fc96526d64

    • SSDEEP

      1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/Q:iEoIlwIguEA4c5DgA9DOyq0eFI

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks