Overview

overview

10

Static

static

10

0dd2f95ab3...0e.exe

windows7_x64

10

0dd2f95ab3...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0dd2f95ab33eeccb4d6d4485f499ed32aa76ef2dd36d56d75d47aa4943cd340e

  • Size

    216KB

  • Sample

    220212-h6qadahdh8

  • MD5

    98f065347843bde16fb0c96042555b63

  • SHA1

    726e024f15cb8f4cb4d2602c20f3056ffbe485cb

  • SHA256

    0dd2f95ab33eeccb4d6d4485f499ed32aa76ef2dd36d56d75d47aa4943cd340e

  • SHA512

    f655eb49c0eb6dc6ae85ff896bf20eccc33bcfbad06734fc28ecafb29522d13f4859c9a9a610e392587ce11de32e0e042e8f860076394bc35333cdac46a00bf8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0dd2f95ab33eeccb4d6d4485f499ed32aa76ef2dd36d56d75d47aa4943cd340e

    • Size

      216KB

    • MD5

      98f065347843bde16fb0c96042555b63

    • SHA1

      726e024f15cb8f4cb4d2602c20f3056ffbe485cb

    • SHA256

      0dd2f95ab33eeccb4d6d4485f499ed32aa76ef2dd36d56d75d47aa4943cd340e

    • SHA512

      f655eb49c0eb6dc6ae85ff896bf20eccc33bcfbad06734fc28ecafb29522d13f4859c9a9a610e392587ce11de32e0e042e8f860076394bc35333cdac46a00bf8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks