Overview

overview

10

Static

static

10

0e274ddcdd...5a.exe

windows7_x64

10

0e274ddcdd...5a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e274ddcdd0d74ac57b17ebc80142c7e47a2a1f8a3db43a11f6a2b12c38de65a

  • Size

    216KB

  • Sample

    220212-h2lrdshdc8

  • MD5

    e19f2f2d9edec7348aa273d553796e97

  • SHA1

    941cc07d47d0ffb7f8da26506c0e4b60ff2f360e

  • SHA256

    0e274ddcdd0d74ac57b17ebc80142c7e47a2a1f8a3db43a11f6a2b12c38de65a

  • SHA512

    87f479ecf539b86de7d37ce5c0b903b05af1262949e199972c2927b45f8f3b9dbe082db2e3af1f7a6132e886de0be6870923a6c5b55efdd5936d21be9a2a5af8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e274ddcdd0d74ac57b17ebc80142c7e47a2a1f8a3db43a11f6a2b12c38de65a

    • Size

      216KB

    • MD5

      e19f2f2d9edec7348aa273d553796e97

    • SHA1

      941cc07d47d0ffb7f8da26506c0e4b60ff2f360e

    • SHA256

      0e274ddcdd0d74ac57b17ebc80142c7e47a2a1f8a3db43a11f6a2b12c38de65a

    • SHA512

      87f479ecf539b86de7d37ce5c0b903b05af1262949e199972c2927b45f8f3b9dbe082db2e3af1f7a6132e886de0be6870923a6c5b55efdd5936d21be9a2a5af8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks