Overview

overview

10

Static

static

10

0dbec21964...0c.exe

windows7_x64

10

0dbec21964...0c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0dbec21964e37459f5c37be6b5993fe446142c0ae0038e65a34f3bcc5ec1c70c

  • Size

    92KB

  • Sample

    220212-h7tn7ahea8

  • MD5

    31e71c51bb37299413d5dfad9afb8284

  • SHA1

    94997a57702466480ce2557f7f6bfd0770c12ed7

  • SHA256

    0dbec21964e37459f5c37be6b5993fe446142c0ae0038e65a34f3bcc5ec1c70c

  • SHA512

    e6dc143a3519095f1c3bdb5cf9b72c3b66f8fb55293782ed404522197e80d981e9aa4e51a9c38f9130ebeff3c18b0bb09f57bd50a126dee7b2b23405a107c2f8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0dbec21964e37459f5c37be6b5993fe446142c0ae0038e65a34f3bcc5ec1c70c

    • Size

      92KB

    • MD5

      31e71c51bb37299413d5dfad9afb8284

    • SHA1

      94997a57702466480ce2557f7f6bfd0770c12ed7

    • SHA256

      0dbec21964e37459f5c37be6b5993fe446142c0ae0038e65a34f3bcc5ec1c70c

    • SHA512

      e6dc143a3519095f1c3bdb5cf9b72c3b66f8fb55293782ed404522197e80d981e9aa4e51a9c38f9130ebeff3c18b0bb09f57bd50a126dee7b2b23405a107c2f8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks