Overview

overview

10

Static

static

10

0deadddc8a...9c.exe

windows7_x64

10

0deadddc8a...9c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0deadddc8aea27c7c5e65f7c5408768659cdac9d0414f2ec525eb96b2ad96e9c

  • Size

    220KB

  • Sample

    220212-h44pzshdf9

  • MD5

    93ddf5a136d204d7b1f0419ad048961f

  • SHA1

    c0a003ccd647a57e036e15c8a2a2d0e594551972

  • SHA256

    0deadddc8aea27c7c5e65f7c5408768659cdac9d0414f2ec525eb96b2ad96e9c

  • SHA512

    6d74b25ab965f1689161ba7bc7503106cebc9a976b00ce8c3f7d94e2bda58a4a878b79dd3f9d83a2382b38ce6708a7687264d238a44608456af1ef7a59b5e0ad

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0deadddc8aea27c7c5e65f7c5408768659cdac9d0414f2ec525eb96b2ad96e9c

    • Size

      220KB

    • MD5

      93ddf5a136d204d7b1f0419ad048961f

    • SHA1

      c0a003ccd647a57e036e15c8a2a2d0e594551972

    • SHA256

      0deadddc8aea27c7c5e65f7c5408768659cdac9d0414f2ec525eb96b2ad96e9c

    • SHA512

      6d74b25ab965f1689161ba7bc7503106cebc9a976b00ce8c3f7d94e2bda58a4a878b79dd3f9d83a2382b38ce6708a7687264d238a44608456af1ef7a59b5e0ad

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks