Overview

overview

10

Static

static

0fedc7dc4a...14.exe

windows7_x64

10

0fedc7dc4a...14.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fedc7dc4ab522c8847cbe0418e8c60640ed90fefbe8d38d1b00e72122bde914

  • Size

    58KB

  • Sample

    220212-g8d5fsafbr

  • MD5

    7e8dfa736952b906c1d426bc47a9cf26

  • SHA1

    56bf1064f3f8b7902baa3d808709379960bf43f4

  • SHA256

    0fedc7dc4ab522c8847cbe0418e8c60640ed90fefbe8d38d1b00e72122bde914

  • SHA512

    d48524bc5ccd2751317d819e3925ea9a66af0586e6abfca8b451860e5b963d98b020cde24f84d29f4a51fcf3e7067400c3c2eca72216865320e4fc136bf25f6e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fedc7dc4ab522c8847cbe0418e8c60640ed90fefbe8d38d1b00e72122bde914

    • Size

      58KB

    • MD5

      7e8dfa736952b906c1d426bc47a9cf26

    • SHA1

      56bf1064f3f8b7902baa3d808709379960bf43f4

    • SHA256

      0fedc7dc4ab522c8847cbe0418e8c60640ed90fefbe8d38d1b00e72122bde914

    • SHA512

      d48524bc5ccd2751317d819e3925ea9a66af0586e6abfca8b451860e5b963d98b020cde24f84d29f4a51fcf3e7067400c3c2eca72216865320e4fc136bf25f6e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks