Overview

overview

10

Static

static

3

391df1a544...4N.exe

windows7-x64

10

391df1a544...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    391df1a54478cf6660133bb89395e990503b10f21f4f14ed41468d46ca06bea4N.exe

  • Size

    35KB

  • Sample

    241211-jgchnaxrel

  • MD5

    6437f0cea952a9c24fa47ded7aa8b6c0

  • SHA1

    4433d6af44ec84c670667828ee627c3837bfb4da

  • SHA256

    391df1a54478cf6660133bb89395e990503b10f21f4f14ed41468d46ca06bea4

  • SHA512

    0dcfd2a8ba46d015ab4a84c44799bb26a1c6f3732acd5f9a5bf4bf410faa3785528929c76acafe563db777e4fc7339095cfc6be99ededf38e5a0b7ae5f44301c

  • SSDEEP

    768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D2:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOc

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      391df1a54478cf6660133bb89395e990503b10f21f4f14ed41468d46ca06bea4N.exe

    • Size

      35KB

    • MD5

      6437f0cea952a9c24fa47ded7aa8b6c0

    • SHA1

      4433d6af44ec84c670667828ee627c3837bfb4da

    • SHA256

      391df1a54478cf6660133bb89395e990503b10f21f4f14ed41468d46ca06bea4

    • SHA512

      0dcfd2a8ba46d015ab4a84c44799bb26a1c6f3732acd5f9a5bf4bf410faa3785528929c76acafe563db777e4fc7339095cfc6be99ededf38e5a0b7ae5f44301c

    • SSDEEP

      768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D2:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOc

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks