Overview

overview

10

Static

static

0fe3af80c4...af.exe

windows7_x64

10

0fe3af80c4...af.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fe3af80c4e7cd12fcce1e4ef037b5141e6b7b327b1a7163b39b2bb3b5214aaf

  • Size

    35KB

  • Sample

    220212-g8vgfaafcp

  • MD5

    0c8a76d781fbd3f005318d74a2a3468b

  • SHA1

    f255524cdd79376fbcd7189af4c63707dcf1d993

  • SHA256

    0fe3af80c4e7cd12fcce1e4ef037b5141e6b7b327b1a7163b39b2bb3b5214aaf

  • SHA512

    fc35a0f89b13cd98875c4da62811174eab22062dff2ec07cd054fbd8d48533d17c5b1ad77e44cce56fe8353c6aa707aedd631ba333ae20d95f68cbea909945db

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fe3af80c4e7cd12fcce1e4ef037b5141e6b7b327b1a7163b39b2bb3b5214aaf

    • Size

      35KB

    • MD5

      0c8a76d781fbd3f005318d74a2a3468b

    • SHA1

      f255524cdd79376fbcd7189af4c63707dcf1d993

    • SHA256

      0fe3af80c4e7cd12fcce1e4ef037b5141e6b7b327b1a7163b39b2bb3b5214aaf

    • SHA512

      fc35a0f89b13cd98875c4da62811174eab22062dff2ec07cd054fbd8d48533d17c5b1ad77e44cce56fe8353c6aa707aedd631ba333ae20d95f68cbea909945db

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks