Overview

overview

10

Static

static

3

0cbb5e1126...fb.exe

windows7-x64

10

0cbb5e1126...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc1b7c9eada68beb4ff0f0ba2f066c0e.bin

  • Size

    56KB

  • Sample

    241119-b6tt8szblm

  • MD5

    e0001b40c0f7db5284af0337e38941cd

  • SHA1

    81c1bf4a75ee3cfdd4fd77323e728b4743ab0be8

  • SHA256

    e0f7c3fdefa3832d5ef5558ea7adb407a9260f7a2d3f5194ce407f31f7c77d58

  • SHA512

    770c9c15471022260cab05fc6cfd3f083eb891ecbdf2bc5e11f3e5d1746d3215e25d9ce0c3d5234d3e82b46f7d464564ae28b3c6c555b7f53c3d4890d9a14f86

  • SSDEEP

    1536:W09DStUht4NUGCbvh74PxVy9xqdEwyKzgTOE+YYW8b:W09DSmT4NY5+xobGbgTDYWW

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      0cbb5e112654c75d39beb00b12f773b7ea44931b6524f8071bdedd91eb7e8efb.exe

    • Size

      58KB

    • MD5

      cc1b7c9eada68beb4ff0f0ba2f066c0e

    • SHA1

      596dea529785d7747a3270a717a9a3c167e1f01e

    • SHA256

      0cbb5e112654c75d39beb00b12f773b7ea44931b6524f8071bdedd91eb7e8efb

    • SHA512

      d5b4ede66ee21b11fd29ff1c714c9ab3b82aa1174082bc078e8d1d037efde85a682c4baccb53c4bf546b3a919ba14429bae972d5dce7023f3eeb53fc96526d64

    • SSDEEP

      1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/Q:iEoIlwIguEA4c5DgA9DOyq0eFI

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks