Overview

overview

10

Static

static

3

c2772fdc3d...ca.exe

windows7-x64

10

c2772fdc3d...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2772fdc3d39c75a7e63a260b7bbeebbd5da45e5b01b55870d093a242dc110ca

  • Size

    58KB

  • Sample

    241124-djx99axkfj

  • MD5

    499a2c533f9ce79d765ae87b109c97d0

  • SHA1

    6dd84f487071f496325197399970b9c3190b33f8

  • SHA256

    c2772fdc3d39c75a7e63a260b7bbeebbd5da45e5b01b55870d093a242dc110ca

  • SHA512

    573bad50e660b536aaae19d806b9299f7bcc24f02d73beaca5cb994da642ca02cf2bd5027b055028e17533e02db04b27cf26db1f65498ac4821c8b7638de1a81

  • SSDEEP

    1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/C:iEoIlwIguEA4c5DgA9DOyq0eFK

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      c2772fdc3d39c75a7e63a260b7bbeebbd5da45e5b01b55870d093a242dc110ca

    • Size

      58KB

    • MD5

      499a2c533f9ce79d765ae87b109c97d0

    • SHA1

      6dd84f487071f496325197399970b9c3190b33f8

    • SHA256

      c2772fdc3d39c75a7e63a260b7bbeebbd5da45e5b01b55870d093a242dc110ca

    • SHA512

      573bad50e660b536aaae19d806b9299f7bcc24f02d73beaca5cb994da642ca02cf2bd5027b055028e17533e02db04b27cf26db1f65498ac4821c8b7638de1a81

    • SSDEEP

      1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/C:iEoIlwIguEA4c5DgA9DOyq0eFK

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks