Overview

overview

10

Static

static

10

0deb0c02a0...3a.exe

windows7_x64

10

0deb0c02a0...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0deb0c02a0d6625e93648991ce9c7b0444db5cf2ad44e1f07af64b62bf0ef73a

  • Size

    99KB

  • Sample

    220212-h42kmahdf8

  • MD5

    31bc96e49a87d4b4953faa56897a5a58

  • SHA1

    b6ddaeab6a0d87b65b60c998aa5d2f38550739df

  • SHA256

    0deb0c02a0d6625e93648991ce9c7b0444db5cf2ad44e1f07af64b62bf0ef73a

  • SHA512

    282af6fed9ac40d27eca6cffebe9635e4faec44ee6413e69d1ac94717da238984565b3f7833727db2693dfb8b94d37ad536671c54d5269554aa596f252bb98bf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0deb0c02a0d6625e93648991ce9c7b0444db5cf2ad44e1f07af64b62bf0ef73a

    • Size

      99KB

    • MD5

      31bc96e49a87d4b4953faa56897a5a58

    • SHA1

      b6ddaeab6a0d87b65b60c998aa5d2f38550739df

    • SHA256

      0deb0c02a0d6625e93648991ce9c7b0444db5cf2ad44e1f07af64b62bf0ef73a

    • SHA512

      282af6fed9ac40d27eca6cffebe9635e4faec44ee6413e69d1ac94717da238984565b3f7833727db2693dfb8b94d37ad536671c54d5269554aa596f252bb98bf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks