Overview

overview

10

Static

static

0fe57972c5...23.exe

windows7_x64

10

0fe57972c5...23.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fe57972c50d6ebe2e3684dd4363343f3d30020d7a7cbcdc450a1386c48b4a23

  • Size

    36KB

  • Sample

    220212-g8sb3safcn

  • MD5

    caa0ab9c8cabe80d780014541537c229

  • SHA1

    5df650a1f29778ee9169e4a86fddae04ad8de975

  • SHA256

    0fe57972c50d6ebe2e3684dd4363343f3d30020d7a7cbcdc450a1386c48b4a23

  • SHA512

    7e61b22979784ca156aec5e5d6619964ffce46542ff12d7b42bfae252b3207d36b234c85b9a8400fd162c1bc5c808383ff092c351dfe451049eab033993cf491

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fe57972c50d6ebe2e3684dd4363343f3d30020d7a7cbcdc450a1386c48b4a23

    • Size

      36KB

    • MD5

      caa0ab9c8cabe80d780014541537c229

    • SHA1

      5df650a1f29778ee9169e4a86fddae04ad8de975

    • SHA256

      0fe57972c50d6ebe2e3684dd4363343f3d30020d7a7cbcdc450a1386c48b4a23

    • SHA512

      7e61b22979784ca156aec5e5d6619964ffce46542ff12d7b42bfae252b3207d36b234c85b9a8400fd162c1bc5c808383ff092c351dfe451049eab033993cf491

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks