Overview

overview

10

Static

static

10

0f6ebe9c0d...3a.exe

windows7_x64

10

0f6ebe9c0d...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f6ebe9c0d86969117a75238bb51ecf4d2e73a2efdb503bd7d7aa2eb392b813a

  • Size

    80KB

  • Sample

    220212-hd24gaagan

  • MD5

    8d842edb121e09b42191396ceb0983c5

  • SHA1

    4d65c006350f7dc147ba3ee0a740920a64882d3f

  • SHA256

    0f6ebe9c0d86969117a75238bb51ecf4d2e73a2efdb503bd7d7aa2eb392b813a

  • SHA512

    fae5527e9be929fada94ebcb9849d406fec1aded418cbcf05c63202e2b857e5db5d51cd11872ea32cc5ac68ef0a1861f5f90684f2b78e21ed1a9b30b756f9405

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f6ebe9c0d86969117a75238bb51ecf4d2e73a2efdb503bd7d7aa2eb392b813a

    • Size

      80KB

    • MD5

      8d842edb121e09b42191396ceb0983c5

    • SHA1

      4d65c006350f7dc147ba3ee0a740920a64882d3f

    • SHA256

      0f6ebe9c0d86969117a75238bb51ecf4d2e73a2efdb503bd7d7aa2eb392b813a

    • SHA512

      fae5527e9be929fada94ebcb9849d406fec1aded418cbcf05c63202e2b857e5db5d51cd11872ea32cc5ac68ef0a1861f5f90684f2b78e21ed1a9b30b756f9405

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks