Overview

overview

10

Static

static

3

8af39cf127...2N.exe

windows7-x64

10

8af39cf127...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8af39cf127ba486f6d40740c65ac05ae212cbdd877be12c2cccb790834b6d0e2N.exe

  • Size

    35KB

  • Sample

    250116-rszfkavqel

  • MD5

    e2d83802e4f31c7bdf86fe1838ae0210

  • SHA1

    d675edf4f73abc3642ef5ac595d002544f877cdd

  • SHA256

    8af39cf127ba486f6d40740c65ac05ae212cbdd877be12c2cccb790834b6d0e2

  • SHA512

    db3a8f835f7a2c314e4d4addb899891b00646c983756b57ccfd3ddd52e166a8a547cffdd546f2fec0f18722565fe0cc294ff37c45ed2c6b0da537f892236b1af

  • SSDEEP

    768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dq:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOs

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      8af39cf127ba486f6d40740c65ac05ae212cbdd877be12c2cccb790834b6d0e2N.exe

    • Size

      35KB

    • MD5

      e2d83802e4f31c7bdf86fe1838ae0210

    • SHA1

      d675edf4f73abc3642ef5ac595d002544f877cdd

    • SHA256

      8af39cf127ba486f6d40740c65ac05ae212cbdd877be12c2cccb790834b6d0e2

    • SHA512

      db3a8f835f7a2c314e4d4addb899891b00646c983756b57ccfd3ddd52e166a8a547cffdd546f2fec0f18722565fe0cc294ff37c45ed2c6b0da537f892236b1af

    • SSDEEP

      768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dq:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOs

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks