Overview

overview

10

Static

static

3

de13a9f169...4N.exe

windows7-x64

10

de13a9f169...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe

  • Size

    58KB

  • Sample

    241123-qscq5avrdv

  • MD5

    5386435162b1f9cf66dcaa7800787fa0

  • SHA1

    a1b08c4415582a026f22d60620e245c15f6a993c

  • SHA256

    de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04

  • SHA512

    f45fcb1ebd7dc27b3d1b1940ca71247009a75b25b0e6c6d1886b1da4f83a8c3596b41c9086a3f007f07aff400dc5b0110e5e080a3a6066ef95bea90fe3fe6857

  • SSDEEP

    1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ//:iEoIlwIguEA4c5DgA9DOyq0eFn

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe

    • Size

      58KB

    • MD5

      5386435162b1f9cf66dcaa7800787fa0

    • SHA1

      a1b08c4415582a026f22d60620e245c15f6a993c

    • SHA256

      de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04

    • SHA512

      f45fcb1ebd7dc27b3d1b1940ca71247009a75b25b0e6c6d1886b1da4f83a8c3596b41c9086a3f007f07aff400dc5b0110e5e080a3a6066ef95bea90fe3fe6857

    • SSDEEP

      1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ//:iEoIlwIguEA4c5DgA9DOyq0eFn

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks