Overview

overview

10

Static

static

0de07605ef...fd.exe

windows7_x64

10

0de07605ef...fd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0de07605ef5d66901eb75220f0fdc8476fbb6d314f181f999570ada8761111fd

  • Size

    35KB

  • Sample

    220212-h574sshdh2

  • MD5

    b351de8282aa5246ee149fb5346cc31a

  • SHA1

    c5e12d7397bcdf2ac192b7258c05769d76d0fc1f

  • SHA256

    0de07605ef5d66901eb75220f0fdc8476fbb6d314f181f999570ada8761111fd

  • SHA512

    0f8d8db3be6319bd566d535e51b5bae33c7025cd4411cece3a5d3b94a2cb655e279cf950c67930c88380a11c614242d023d83be524d9f99eda0c830b2317b373

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0de07605ef5d66901eb75220f0fdc8476fbb6d314f181f999570ada8761111fd

    • Size

      35KB

    • MD5

      b351de8282aa5246ee149fb5346cc31a

    • SHA1

      c5e12d7397bcdf2ac192b7258c05769d76d0fc1f

    • SHA256

      0de07605ef5d66901eb75220f0fdc8476fbb6d314f181f999570ada8761111fd

    • SHA512

      0f8d8db3be6319bd566d535e51b5bae33c7025cd4411cece3a5d3b94a2cb655e279cf950c67930c88380a11c614242d023d83be524d9f99eda0c830b2317b373

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks