Overview

overview

10

Static

static

10

0ff0acb4fb...6f.exe

windows7_x64

10

0ff0acb4fb...6f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ff0acb4fbca1d2d25cd305740434840470f0591f5dac13cf4e5d7008bd5526f

  • Size

    79KB

  • Sample

    220212-g75wsaafbp

  • MD5

    6cdc9fd181e32103ccb4e81278642d68

  • SHA1

    1bd87c32868d9583db80ee6eff4e6790ce85fa37

  • SHA256

    0ff0acb4fbca1d2d25cd305740434840470f0591f5dac13cf4e5d7008bd5526f

  • SHA512

    179cabef0009d357f9ce44afa10aab462633b9220d19c023e55c541fa5e1039144901f5ce618168bdf9278a8c735abfc1d35d6eed81f932c820e2e3b8bca8122

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ff0acb4fbca1d2d25cd305740434840470f0591f5dac13cf4e5d7008bd5526f

    • Size

      79KB

    • MD5

      6cdc9fd181e32103ccb4e81278642d68

    • SHA1

      1bd87c32868d9583db80ee6eff4e6790ce85fa37

    • SHA256

      0ff0acb4fbca1d2d25cd305740434840470f0591f5dac13cf4e5d7008bd5526f

    • SHA512

      179cabef0009d357f9ce44afa10aab462633b9220d19c023e55c541fa5e1039144901f5ce618168bdf9278a8c735abfc1d35d6eed81f932c820e2e3b8bca8122

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks