Overview

overview

10

Static

static

10

0de3dc731f...bf.exe

windows7_x64

10

0de3dc731f...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf

  • Size

    99KB

  • Sample

    220212-h5tw6sbadj

  • MD5

    6a6f502ce1bf1ed046e3881d0333ad0d

  • SHA1

    47f5b8108acefbe7ad972fbe5365818b097daaaa

  • SHA256

    0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf

  • SHA512

    577c09a82bb52c0a068781fe4e3f84f6c1153baa69b0b31f7cb8052aeb7fefcd7e9e489b450dfb9311d6ad24a6bb9faaed75ebccfbf205761f7c203a08e3d16d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf

    • Size

      99KB

    • MD5

      6a6f502ce1bf1ed046e3881d0333ad0d

    • SHA1

      47f5b8108acefbe7ad972fbe5365818b097daaaa

    • SHA256

      0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf

    • SHA512

      577c09a82bb52c0a068781fe4e3f84f6c1153baa69b0b31f7cb8052aeb7fefcd7e9e489b450dfb9311d6ad24a6bb9faaed75ebccfbf205761f7c203a08e3d16d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks