Overview

overview

10

Static

static

0fb541e92b...b2.exe

windows7_x64

10

0fb541e92b...b2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fb541e92b7601f6afbc63183dd753cdd57c0bf83c6f910cc66c55a2838ddcb2

  • Size

    36KB

  • Sample

    220212-ha3wlahba2

  • MD5

    58b85fe202bd721279e3c949a768d001

  • SHA1

    ffade5ca25c2b345143d139cfc6b525b99ea7491

  • SHA256

    0fb541e92b7601f6afbc63183dd753cdd57c0bf83c6f910cc66c55a2838ddcb2

  • SHA512

    ca2f2d0e1517dead1a5a7f363525e211fa48051eed6482b26b588179b4ab530626f30186233e9e199ad43ef2abf419643969c5de9ffb360711791ea6bdf5cd52

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fb541e92b7601f6afbc63183dd753cdd57c0bf83c6f910cc66c55a2838ddcb2

    • Size

      36KB

    • MD5

      58b85fe202bd721279e3c949a768d001

    • SHA1

      ffade5ca25c2b345143d139cfc6b525b99ea7491

    • SHA256

      0fb541e92b7601f6afbc63183dd753cdd57c0bf83c6f910cc66c55a2838ddcb2

    • SHA512

      ca2f2d0e1517dead1a5a7f363525e211fa48051eed6482b26b588179b4ab530626f30186233e9e199ad43ef2abf419643969c5de9ffb360711791ea6bdf5cd52

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks