Overview

overview

10

Static

static

10

0fb29a584e...7a.exe

windows7_x64

10

0fb29a584e...7a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fb29a584eb880ef530d7c2d9ec79674223232b1b10bdd8c6918f88d8cb4b27a

  • Size

    99KB

  • Sample

    220212-ha76baaffm

  • MD5

    2d77a12a3da6ae20200a7f8ec9502eb0

  • SHA1

    0b7d40a7bfaa7e23df0c7a6de308bf3234f1aa71

  • SHA256

    0fb29a584eb880ef530d7c2d9ec79674223232b1b10bdd8c6918f88d8cb4b27a

  • SHA512

    c052b37a66d39a504e7df1510af67a9d7198c5287552b7dde3cf7435470cea4f39954c8f3493759a41b27250e3c9aeb3c9e3c9dbb5eaa04180213a102da940a9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fb29a584eb880ef530d7c2d9ec79674223232b1b10bdd8c6918f88d8cb4b27a

    • Size

      99KB

    • MD5

      2d77a12a3da6ae20200a7f8ec9502eb0

    • SHA1

      0b7d40a7bfaa7e23df0c7a6de308bf3234f1aa71

    • SHA256

      0fb29a584eb880ef530d7c2d9ec79674223232b1b10bdd8c6918f88d8cb4b27a

    • SHA512

      c052b37a66d39a504e7df1510af67a9d7198c5287552b7dde3cf7435470cea4f39954c8f3493759a41b27250e3c9aeb3c9e3c9dbb5eaa04180213a102da940a9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks