Overview

overview

10

Static

static

0fc2798f69...2b.exe

windows7_x64

10

0fc2798f69...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fc2798f6943de649ce7d6f5a13dfa816739682e9d2103139177eafef84c252b

  • Size

    60KB

  • Sample

    220212-haj4gshah5

  • MD5

    24c04a8acf2b4f8c6c00fec40df4f450

  • SHA1

    20f6e5f2d83b32d456dad5e474183698c6617f59

  • SHA256

    0fc2798f6943de649ce7d6f5a13dfa816739682e9d2103139177eafef84c252b

  • SHA512

    356db8e0bc7de2946c879ca0d590a68e5360de8e9adb9943db1e6612465f99d700dae1c4161dcd91e2bd9f8a34b6fcd0b4742bf9e2dd4c5f17be737d091fef2e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fc2798f6943de649ce7d6f5a13dfa816739682e9d2103139177eafef84c252b

    • Size

      60KB

    • MD5

      24c04a8acf2b4f8c6c00fec40df4f450

    • SHA1

      20f6e5f2d83b32d456dad5e474183698c6617f59

    • SHA256

      0fc2798f6943de649ce7d6f5a13dfa816739682e9d2103139177eafef84c252b

    • SHA512

      356db8e0bc7de2946c879ca0d590a68e5360de8e9adb9943db1e6612465f99d700dae1c4161dcd91e2bd9f8a34b6fcd0b4742bf9e2dd4c5f17be737d091fef2e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks