Overview

overview

10

Static

static

10

0f8e3ceca5...8a.exe

windows7_x64

10

0f8e3ceca5...8a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f8e3ceca5cd074a725ef0cb36faa047ff3eb73f3451ffe78a82f31c9fa0e48a

  • Size

    216KB

  • Sample

    220212-hckg2ahbb6

  • MD5

    6a1cbeabff85b5d2525b3dc8123642e1

  • SHA1

    9fc4c03e743b62a5723760c466837c8534d0bb42

  • SHA256

    0f8e3ceca5cd074a725ef0cb36faa047ff3eb73f3451ffe78a82f31c9fa0e48a

  • SHA512

    36faaaebae482d23ced51f8ee9a1fde146fe6a2a4a60c807b83fd920e8eb374488b3c971a02df2d6a6c0a6931d1ec4597fcc62f9d76b5a80384cf10ec2598a47

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f8e3ceca5cd074a725ef0cb36faa047ff3eb73f3451ffe78a82f31c9fa0e48a

    • Size

      216KB

    • MD5

      6a1cbeabff85b5d2525b3dc8123642e1

    • SHA1

      9fc4c03e743b62a5723760c466837c8534d0bb42

    • SHA256

      0f8e3ceca5cd074a725ef0cb36faa047ff3eb73f3451ffe78a82f31c9fa0e48a

    • SHA512

      36faaaebae482d23ced51f8ee9a1fde146fe6a2a4a60c807b83fd920e8eb374488b3c971a02df2d6a6c0a6931d1ec4597fcc62f9d76b5a80384cf10ec2598a47

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks