Overview

overview

10

Static

static

10

0fe1687c63...69.exe

windows7_x64

10

0fe1687c63...69.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fe1687c63b2744f08299f7fc3511b80d9bbcf161728ed04dd093fa1a6498269

  • Size

    80KB

  • Sample

    220212-g82whsafdj

  • MD5

    80b0ba58ef46124002fb5584ef0a3b87

  • SHA1

    7179a1fd51dc8cb634ed01087249883a2f890d9e

  • SHA256

    0fe1687c63b2744f08299f7fc3511b80d9bbcf161728ed04dd093fa1a6498269

  • SHA512

    b87f6f630d1cdce8326ac7a5044c891ab0c934d65662d113d3033a2e91b68bd9c6e2d4339e131932fc717a1ad5ec53dbc0524607c682aed09011e65c5ee04b52

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fe1687c63b2744f08299f7fc3511b80d9bbcf161728ed04dd093fa1a6498269

    • Size

      80KB

    • MD5

      80b0ba58ef46124002fb5584ef0a3b87

    • SHA1

      7179a1fd51dc8cb634ed01087249883a2f890d9e

    • SHA256

      0fe1687c63b2744f08299f7fc3511b80d9bbcf161728ed04dd093fa1a6498269

    • SHA512

      b87f6f630d1cdce8326ac7a5044c891ab0c934d65662d113d3033a2e91b68bd9c6e2d4339e131932fc717a1ad5ec53dbc0524607c682aed09011e65c5ee04b52

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks