Overview

overview

10

Static

static

0fd709aa8b...13.exe

windows7_x64

10

0fd709aa8b...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fd709aa8bd53c6973f5ddc829b0309cefeb5e81565b857f04a9c1c1eaba8813

  • Size

    60KB

  • Sample

    220212-g8658shaf9

  • MD5

    1dfbddf013edb1383cf8faed6546e2df

  • SHA1

    0255db0ad1e64d9af9155a9ea2042583f6e8f15d

  • SHA256

    0fd709aa8bd53c6973f5ddc829b0309cefeb5e81565b857f04a9c1c1eaba8813

  • SHA512

    b1e17eb017f1db3e7d0eee347492c3b3f6abce90206981453a357e77ab7ede4a29035398311e9243dbea82c5dc0bdb7fc248470e97372989f221c4048ae01c1c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fd709aa8bd53c6973f5ddc829b0309cefeb5e81565b857f04a9c1c1eaba8813

    • Size

      60KB

    • MD5

      1dfbddf013edb1383cf8faed6546e2df

    • SHA1

      0255db0ad1e64d9af9155a9ea2042583f6e8f15d

    • SHA256

      0fd709aa8bd53c6973f5ddc829b0309cefeb5e81565b857f04a9c1c1eaba8813

    • SHA512

      b1e17eb017f1db3e7d0eee347492c3b3f6abce90206981453a357e77ab7ede4a29035398311e9243dbea82c5dc0bdb7fc248470e97372989f221c4048ae01c1c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks