Overview

overview

10

Static

static

0f9a6c89e7...13.exe

windows7_x64

10

0f9a6c89e7...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f9a6c89e7c68aa819d77239f06d020f8fbd7068145cc66f51298f45f53ccf13

  • Size

    60KB

  • Sample

    220212-hb9ersafgp

  • MD5

    d655b6be19e4a1d83168785cbeafe856

  • SHA1

    5e5364b4fb28ada1cb6af60dd67c05d58efd0298

  • SHA256

    0f9a6c89e7c68aa819d77239f06d020f8fbd7068145cc66f51298f45f53ccf13

  • SHA512

    50229ab78d329db12bbe6e1915b73d2ec00402b75e21bb0e6a2f9ad99a10527682bbd860235902aa48a094cb4e718f607808564b7fad75f3872b90b6d2668ab1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f9a6c89e7c68aa819d77239f06d020f8fbd7068145cc66f51298f45f53ccf13

    • Size

      60KB

    • MD5

      d655b6be19e4a1d83168785cbeafe856

    • SHA1

      5e5364b4fb28ada1cb6af60dd67c05d58efd0298

    • SHA256

      0f9a6c89e7c68aa819d77239f06d020f8fbd7068145cc66f51298f45f53ccf13

    • SHA512

      50229ab78d329db12bbe6e1915b73d2ec00402b75e21bb0e6a2f9ad99a10527682bbd860235902aa48a094cb4e718f607808564b7fad75f3872b90b6d2668ab1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks