Overview

overview

10

Static

static

0d95e8f9b6...32.exe

windows7_x64

10

0d95e8f9b6...32.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d95e8f9b684be9c52ea187b754a28d7f3eb651d2590988a22b29177dff19b32

  • Size

    60KB

  • Sample

    220212-h9sjxahed3

  • MD5

    728e8d293a336d94011f1ac2a2ace865

  • SHA1

    0508ddcfa642c0ce44235bec7d1da876b272be5a

  • SHA256

    0d95e8f9b684be9c52ea187b754a28d7f3eb651d2590988a22b29177dff19b32

  • SHA512

    9a2a98c0250edf76c051f3a1e966bec7306af2fd39eca067933af3ed87e53c3dc5647430fbdba8b3f0d9ef7c2c9b2f6d001b1158ac5de4f4041614beef90b269

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0d95e8f9b684be9c52ea187b754a28d7f3eb651d2590988a22b29177dff19b32

    • Size

      60KB

    • MD5

      728e8d293a336d94011f1ac2a2ace865

    • SHA1

      0508ddcfa642c0ce44235bec7d1da876b272be5a

    • SHA256

      0d95e8f9b684be9c52ea187b754a28d7f3eb651d2590988a22b29177dff19b32

    • SHA512

      9a2a98c0250edf76c051f3a1e966bec7306af2fd39eca067933af3ed87e53c3dc5647430fbdba8b3f0d9ef7c2c9b2f6d001b1158ac5de4f4041614beef90b269

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks