Overview

overview

10

Static

static

10

0feace3d33...8c.exe

windows7_x64

10

0feace3d33...8c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0feace3d3300466521fd6c2d2c10ead613a1c8f7755678eab6014de825eec48c

  • Size

    191KB

  • Sample

    220212-g8jd6safcj

  • MD5

    b20326d5dedc033cdda9a6bc33168dd5

  • SHA1

    37f0c9a388419bbf5a878f0edc685247fdaa3efc

  • SHA256

    0feace3d3300466521fd6c2d2c10ead613a1c8f7755678eab6014de825eec48c

  • SHA512

    6456daf5cf8d320caf6464bf7e4d9bb63423d31e568e74880dddb13d2aa0483521437c3f469f1e7bb8486473a73107cc2d146d126df49afdccc799014c107377

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0feace3d3300466521fd6c2d2c10ead613a1c8f7755678eab6014de825eec48c

    • Size

      191KB

    • MD5

      b20326d5dedc033cdda9a6bc33168dd5

    • SHA1

      37f0c9a388419bbf5a878f0edc685247fdaa3efc

    • SHA256

      0feace3d3300466521fd6c2d2c10ead613a1c8f7755678eab6014de825eec48c

    • SHA512

      6456daf5cf8d320caf6464bf7e4d9bb63423d31e568e74880dddb13d2aa0483521437c3f469f1e7bb8486473a73107cc2d146d126df49afdccc799014c107377

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks