Overview

overview

10

Static

static

10

0dd9df1713...09.exe

windows7_x64

10

0dd9df1713...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0dd9df1713a7adb825dbf06f1490b2df42ad96aab773252cf1eee702f0df9109

  • Size

    192KB

  • Sample

    220212-h6h63ahdh7

  • MD5

    1ed60c481ca02688c177e3cc73dfd992

  • SHA1

    b30a662f49386fe9406f34a08bffb8940f95f5fd

  • SHA256

    0dd9df1713a7adb825dbf06f1490b2df42ad96aab773252cf1eee702f0df9109

  • SHA512

    c292e82482910ec0f4071af036d1a468d8a56d802f114050afa6f560b92b0c0cd5d98240f02314e84851526b7cc4b6137914a91949cfb18ea4d1bf2325779b21

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0dd9df1713a7adb825dbf06f1490b2df42ad96aab773252cf1eee702f0df9109

    • Size

      192KB

    • MD5

      1ed60c481ca02688c177e3cc73dfd992

    • SHA1

      b30a662f49386fe9406f34a08bffb8940f95f5fd

    • SHA256

      0dd9df1713a7adb825dbf06f1490b2df42ad96aab773252cf1eee702f0df9109

    • SHA512

      c292e82482910ec0f4071af036d1a468d8a56d802f114050afa6f560b92b0c0cd5d98240f02314e84851526b7cc4b6137914a91949cfb18ea4d1bf2325779b21

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks