Overview

overview

10

Static

static

10

0da1e0a437...f1.exe

windows7_x64

10

0da1e0a437...f1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0da1e0a437614c47ffa88b209eacb132d749de87911d739f9f952e1902e9c6f1

  • Size

    79KB

  • Sample

    220212-h9adbshec6

  • MD5

    afdf7b10573b9b64552217161c12b49e

  • SHA1

    eadde779cce61de777ed61389e7a3f9f542e119e

  • SHA256

    0da1e0a437614c47ffa88b209eacb132d749de87911d739f9f952e1902e9c6f1

  • SHA512

    a36559e3a1a1c602b7ba28c332d0861d482823d4440c76a827e4fb6e2ea2d9d87e5708200251ab188b002c6fe3a83b8811ff13411c13e66d17a9749018a5d8f0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0da1e0a437614c47ffa88b209eacb132d749de87911d739f9f952e1902e9c6f1

    • Size

      79KB

    • MD5

      afdf7b10573b9b64552217161c12b49e

    • SHA1

      eadde779cce61de777ed61389e7a3f9f542e119e

    • SHA256

      0da1e0a437614c47ffa88b209eacb132d749de87911d739f9f952e1902e9c6f1

    • SHA512

      a36559e3a1a1c602b7ba28c332d0861d482823d4440c76a827e4fb6e2ea2d9d87e5708200251ab188b002c6fe3a83b8811ff13411c13e66d17a9749018a5d8f0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks