Overview

overview

10

Static

static

0ff081af62...21.exe

windows7_x64

10

0ff081af62...21.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ff081af6221fc903ab1ec8ab6a9bb5e07dd776d29429b8c473da57f604bcc21

  • Size

    36KB

  • Sample

    220212-g796hahaf4

  • MD5

    5eb8f362327a25b1aa2a3b49a6635546

  • SHA1

    31f2e3d47e92da47aa1eae74c3e15b981ff3dbb9

  • SHA256

    0ff081af6221fc903ab1ec8ab6a9bb5e07dd776d29429b8c473da57f604bcc21

  • SHA512

    358cd37308e6f99dab2f4b76ce242581759eb67596a14057f8af3f77bbc05b50338c18b558c152c56beec5f671ef436566fbd4800d6957c57255ca1cd9d41532

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ff081af6221fc903ab1ec8ab6a9bb5e07dd776d29429b8c473da57f604bcc21

    • Size

      36KB

    • MD5

      5eb8f362327a25b1aa2a3b49a6635546

    • SHA1

      31f2e3d47e92da47aa1eae74c3e15b981ff3dbb9

    • SHA256

      0ff081af6221fc903ab1ec8ab6a9bb5e07dd776d29429b8c473da57f604bcc21

    • SHA512

      358cd37308e6f99dab2f4b76ce242581759eb67596a14057f8af3f77bbc05b50338c18b558c152c56beec5f671ef436566fbd4800d6957c57255ca1cd9d41532

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks