Overview

overview

10

Static

static

3

b6aa7d0f47...f1.exe

windows7-x64

10

b6aa7d0f47...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6aa7d0f474b2431b2064a03f8606dcedbcde6eab20da10ef8034f9f9512f8f1

  • Size

    36KB

  • Sample

    241217-cqewtaykbm

  • MD5

    760590931ba42094c53c80bed40b2d60

  • SHA1

    9240af64675f969302d7d2c8738a726b69fec49b

  • SHA256

    b6aa7d0f474b2431b2064a03f8606dcedbcde6eab20da10ef8034f9f9512f8f1

  • SHA512

    1914456957f7d04e1db05918d45273525a929cdc525e66dc91f9019e08d3242197224a7a755575e58c7f992573dd733c07969f55b342577f3892b90e1ecdb1e8

  • SSDEEP

    768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D4:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOe

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      b6aa7d0f474b2431b2064a03f8606dcedbcde6eab20da10ef8034f9f9512f8f1

    • Size

      36KB

    • MD5

      760590931ba42094c53c80bed40b2d60

    • SHA1

      9240af64675f969302d7d2c8738a726b69fec49b

    • SHA256

      b6aa7d0f474b2431b2064a03f8606dcedbcde6eab20da10ef8034f9f9512f8f1

    • SHA512

      1914456957f7d04e1db05918d45273525a929cdc525e66dc91f9019e08d3242197224a7a755575e58c7f992573dd733c07969f55b342577f3892b90e1ecdb1e8

    • SSDEEP

      768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D4:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOe

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks