Overview

overview

10

Static

static

0fb9ac5c5c...ad.exe

windows7_x64

10

0fb9ac5c5c...ad.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fb9ac5c5c1fa2ec499bd6db101c1fe00f287e3e68ab509690fd7a78907092ad

  • Size

    36KB

  • Sample

    220212-hav6rahah9

  • MD5

    b9957b3ad97b093c4de8e98e7f101df8

  • SHA1

    f15fad18095b9975d648da7278b50e8555bbc7b9

  • SHA256

    0fb9ac5c5c1fa2ec499bd6db101c1fe00f287e3e68ab509690fd7a78907092ad

  • SHA512

    e82ce320fc91daf22a0bbecb2b3513f23cb3b38b6e5f403236dfc583f7222d2fc2d84293f0d5745b66baa9629ace974d7e02320e215045dc92686b38d53b1415

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0fb9ac5c5c1fa2ec499bd6db101c1fe00f287e3e68ab509690fd7a78907092ad

    • Size

      36KB

    • MD5

      b9957b3ad97b093c4de8e98e7f101df8

    • SHA1

      f15fad18095b9975d648da7278b50e8555bbc7b9

    • SHA256

      0fb9ac5c5c1fa2ec499bd6db101c1fe00f287e3e68ab509690fd7a78907092ad

    • SHA512

      e82ce320fc91daf22a0bbecb2b3513f23cb3b38b6e5f403236dfc583f7222d2fc2d84293f0d5745b66baa9629ace974d7e02320e215045dc92686b38d53b1415

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks