Overview

overview

10

Static

static

10

0f85af37b5...1b.exe

windows7_x64

10

0f85af37b5...1b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f85af37b55362e494a766e9121da3e33dddbbc6c834ca6add32567bd199f81b

  • Size

    99KB

  • Sample

    220212-hc3zdahbc2

  • MD5

    163264bf5da5528c24152def500922fd

  • SHA1

    489a11229b022fda052e1d29add2acc0c75fc5b6

  • SHA256

    0f85af37b55362e494a766e9121da3e33dddbbc6c834ca6add32567bd199f81b

  • SHA512

    4c50646337b4f24364e6628474e146e0f1ff5a7c893ed1af8fd0474df87e92510b077560ecb5907e5dd5e9bd4269606b1066bbd0f254f5b6fb7d2c7b420de9bf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f85af37b55362e494a766e9121da3e33dddbbc6c834ca6add32567bd199f81b

    • Size

      99KB

    • MD5

      163264bf5da5528c24152def500922fd

    • SHA1

      489a11229b022fda052e1d29add2acc0c75fc5b6

    • SHA256

      0f85af37b55362e494a766e9121da3e33dddbbc6c834ca6add32567bd199f81b

    • SHA512

      4c50646337b4f24364e6628474e146e0f1ff5a7c893ed1af8fd0474df87e92510b077560ecb5907e5dd5e9bd4269606b1066bbd0f254f5b6fb7d2c7b420de9bf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks