Overview

overview

10

Static

static

0fcb8ec62e...bc.exe

windows7_x64

10

0fcb8ec62e...bc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fcb8ec62ec09a8d28f28fbd9770f178af867fa0e0866adb58f72467d8e636bc

  • Size

    36KB

  • Sample

    220212-g92l5shah2

  • MD5

    89648e27787de9228db3ace1c75bc1ce

  • SHA1

    f4e0397dd756d760cdcd5a42ffc0a6c3378df009

  • SHA256

    0fcb8ec62ec09a8d28f28fbd9770f178af867fa0e0866adb58f72467d8e636bc

  • SHA512

    d7f68236246cc46a1e30ec27d1ceb720610e711f1ab824e6e9aca7ef7a68f1c0d93ce6d841cb0e64620f4c70ec28fc68992ba7e69d46420a70911e1522d15c64

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fcb8ec62ec09a8d28f28fbd9770f178af867fa0e0866adb58f72467d8e636bc

    • Size

      36KB

    • MD5

      89648e27787de9228db3ace1c75bc1ce

    • SHA1

      f4e0397dd756d760cdcd5a42ffc0a6c3378df009

    • SHA256

      0fcb8ec62ec09a8d28f28fbd9770f178af867fa0e0866adb58f72467d8e636bc

    • SHA512

      d7f68236246cc46a1e30ec27d1ceb720610e711f1ab824e6e9aca7ef7a68f1c0d93ce6d841cb0e64620f4c70ec28fc68992ba7e69d46420a70911e1522d15c64

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks