Overview

overview

10

Static

static

10

0e2c6a0673...b5.exe

windows7_x64

10

0e2c6a0673...b5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e2c6a067389dcd6cd019e81eb2c4cb6718e638d12d04aafa337b629ff905db5

  • Size

    150KB

  • Sample

    220212-h11txshdc2

  • MD5

    f7da0b36b4d93c2e0cb5c052322e94f5

  • SHA1

    bb89102489b8a1fd02c51c608f83eae7bbe48cfb

  • SHA256

    0e2c6a067389dcd6cd019e81eb2c4cb6718e638d12d04aafa337b629ff905db5

  • SHA512

    2d4a29f7e008f1133653b2ad0c44b8e597ae0ade93f653ebe234e647487c09f89fcc1ed469c8d48b2b9f9d3c9832bd3a6635027bc9fbc7f8c801e9a17a7accf2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e2c6a067389dcd6cd019e81eb2c4cb6718e638d12d04aafa337b629ff905db5

    • Size

      150KB

    • MD5

      f7da0b36b4d93c2e0cb5c052322e94f5

    • SHA1

      bb89102489b8a1fd02c51c608f83eae7bbe48cfb

    • SHA256

      0e2c6a067389dcd6cd019e81eb2c4cb6718e638d12d04aafa337b629ff905db5

    • SHA512

      2d4a29f7e008f1133653b2ad0c44b8e597ae0ade93f653ebe234e647487c09f89fcc1ed469c8d48b2b9f9d3c9832bd3a6635027bc9fbc7f8c801e9a17a7accf2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks