General
- Target f923a5fc105d94e09cc4a64e090739aedc73fe58daea3c1423187c0c8d4f777f
- Size 164KB
- Sample261010-krx3saswcs
- SHA256 f923a5fc105d94e09cc4a64e090739aedc73fe58daea3c1423187c0c8d4f777f
Score
10/10
Malware Config
Targets
-
- Target f923a5fc105d94e09cc4a64e090739aedc73fe58daea3c1423187c0c8d4f777f
- Size 164KB
- SHA256 f923a5fc105d94e09cc4a64e090739aedc73fe58daea3c1423187c0c8d4f777f
Score10/10Family: Sakula
Sakula is a remote access trojan with various capabilities.
Sakula payload
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1