Overview

overview

10

Static

static

0d8efc1a59...10.exe

windows7_x64

10

0d8efc1a59...10.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d8efc1a59fbd70f61afe9664fa90b75c7817596b71cf8fbf9d9171c00b1ee10

  • Size

    36KB

  • Sample

    220212-h92skshed5

  • MD5

    5ca52239338e20b6eaea43c925f007a9

  • SHA1

    f12b521dda832ef822a010841e09e538c02c1b25

  • SHA256

    0d8efc1a59fbd70f61afe9664fa90b75c7817596b71cf8fbf9d9171c00b1ee10

  • SHA512

    aabd779b2e59f794e24a8fe8e9d8f384c37b399d5aae64fbc96839ffd6748068a1ff6a4a9f400695883fcbb26354e0caf6a5baa2cd50fca812773fddcb716206

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0d8efc1a59fbd70f61afe9664fa90b75c7817596b71cf8fbf9d9171c00b1ee10

    • Size

      36KB

    • MD5

      5ca52239338e20b6eaea43c925f007a9

    • SHA1

      f12b521dda832ef822a010841e09e538c02c1b25

    • SHA256

      0d8efc1a59fbd70f61afe9664fa90b75c7817596b71cf8fbf9d9171c00b1ee10

    • SHA512

      aabd779b2e59f794e24a8fe8e9d8f384c37b399d5aae64fbc96839ffd6748068a1ff6a4a9f400695883fcbb26354e0caf6a5baa2cd50fca812773fddcb716206

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks