Overview

overview

10

Static

static

10

0de1df827e...77.exe

windows7_x64

10

0de1df827e...77.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0de1df827ec27e819f99f5949251ec4121b199cde527561d345ca9d219ef1877

  • Size

    80KB

  • Sample

    220212-h51pqahdg7

  • MD5

    26a3cd52e1ad4d6e1ef3ebad896b1adb

  • SHA1

    864ee15d07b75ca292078f3c27b31fdf10e85c3e

  • SHA256

    0de1df827ec27e819f99f5949251ec4121b199cde527561d345ca9d219ef1877

  • SHA512

    fb881d53de07349a3538881488f656af3ed6e5f4704dd755e8be3d86b7ae59801dd3e5e97de88b1a378fd932a48140415698c7eda47b7d80fbd94e8556c2c4e7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0de1df827ec27e819f99f5949251ec4121b199cde527561d345ca9d219ef1877

    • Size

      80KB

    • MD5

      26a3cd52e1ad4d6e1ef3ebad896b1adb

    • SHA1

      864ee15d07b75ca292078f3c27b31fdf10e85c3e

    • SHA256

      0de1df827ec27e819f99f5949251ec4121b199cde527561d345ca9d219ef1877

    • SHA512

      fb881d53de07349a3538881488f656af3ed6e5f4704dd755e8be3d86b7ae59801dd3e5e97de88b1a378fd932a48140415698c7eda47b7d80fbd94e8556c2c4e7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks