Overview

overview

10

Static

static

0db0e54e14...74.exe

windows7_x64

10

0db0e54e14...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0db0e54e14e9e9a74590c5b0f4b1283f89e82edf7dd49cb9fd80c4752a482f74

  • Size

    36KB

  • Sample

    220212-h8lpzaheb7

  • MD5

    4c7f8abdd3b67a73d556955f98b5b534

  • SHA1

    c49b907216a8efe23a5b0426a458738f9574ab08

  • SHA256

    0db0e54e14e9e9a74590c5b0f4b1283f89e82edf7dd49cb9fd80c4752a482f74

  • SHA512

    c619402fc4f5509cea1471cd64323fc18a210a02d8ea04ac5d2fa278c10b1ae5a9611747dde102009c368a0b2433856e4cde5ca338a2bb60727d7a7eb6b098c9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0db0e54e14e9e9a74590c5b0f4b1283f89e82edf7dd49cb9fd80c4752a482f74

    • Size

      36KB

    • MD5

      4c7f8abdd3b67a73d556955f98b5b534

    • SHA1

      c49b907216a8efe23a5b0426a458738f9574ab08

    • SHA256

      0db0e54e14e9e9a74590c5b0f4b1283f89e82edf7dd49cb9fd80c4752a482f74

    • SHA512

      c619402fc4f5509cea1471cd64323fc18a210a02d8ea04ac5d2fa278c10b1ae5a9611747dde102009c368a0b2433856e4cde5ca338a2bb60727d7a7eb6b098c9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks