Overview

overview

10

Static

static

3

72ff498ed0...30.exe

windows7-x64

10

72ff498ed0...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72ff498ed0ed4ba58b6f7e0ff1939cb41760c6c98abf4b7f160165fbbd582530

  • Size

    58KB

  • Sample

    250111-b6cwqazpbr

  • MD5

    42bb7772450cefcb161a9f82c4086246

  • SHA1

    08675ecd8e1882124c4e32859978828743ca7a0e

  • SHA256

    72ff498ed0ed4ba58b6f7e0ff1939cb41760c6c98abf4b7f160165fbbd582530

  • SHA512

    c8ac3fd8ff70404365a4ec81dee3245b14b7d6ecb5ef9811a58ee684d6029b2ce82cd7ba03009ded4965ad64cfd4e7b8c05193c67b9b7215289a9cbdadceacbb

  • SSDEEP

    1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/h:iEoIlwIguEA4c5DgA9DOyq0eFp

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      72ff498ed0ed4ba58b6f7e0ff1939cb41760c6c98abf4b7f160165fbbd582530

    • Size

      58KB

    • MD5

      42bb7772450cefcb161a9f82c4086246

    • SHA1

      08675ecd8e1882124c4e32859978828743ca7a0e

    • SHA256

      72ff498ed0ed4ba58b6f7e0ff1939cb41760c6c98abf4b7f160165fbbd582530

    • SHA512

      c8ac3fd8ff70404365a4ec81dee3245b14b7d6ecb5ef9811a58ee684d6029b2ce82cd7ba03009ded4965ad64cfd4e7b8c05193c67b9b7215289a9cbdadceacbb

    • SSDEEP

      1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/h:iEoIlwIguEA4c5DgA9DOyq0eFp

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks