Overview

overview

10

Static

static

10

0e1c7b7c49...70.exe

windows7_x64

10

0e1c7b7c49...70.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e1c7b7c493cbf7e5f29471baac175382f0a250ca909746858bd16d8ec4f2570

  • Size

    176KB

  • Sample

    220212-h3g5lahdd8

  • MD5

    ae7fb1d5a8a95ecfe749addfebc3f433

  • SHA1

    b32fa035a3cd13e7cc92110f97ca665f9bc3db85

  • SHA256

    0e1c7b7c493cbf7e5f29471baac175382f0a250ca909746858bd16d8ec4f2570

  • SHA512

    c009a1ecf36b40b7aa7852201a41e4d31c996fa300af8725c8e149611139753bf7e1eb292af3f46b28d8db18da001891b037ef0b52a654aa2aafbffdb3dce74c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e1c7b7c493cbf7e5f29471baac175382f0a250ca909746858bd16d8ec4f2570

    • Size

      176KB

    • MD5

      ae7fb1d5a8a95ecfe749addfebc3f433

    • SHA1

      b32fa035a3cd13e7cc92110f97ca665f9bc3db85

    • SHA256

      0e1c7b7c493cbf7e5f29471baac175382f0a250ca909746858bd16d8ec4f2570

    • SHA512

      c009a1ecf36b40b7aa7852201a41e4d31c996fa300af8725c8e149611139753bf7e1eb292af3f46b28d8db18da001891b037ef0b52a654aa2aafbffdb3dce74c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks