Overview

overview

10

Static

static

10

0f766c491e...63.exe

windows7_x64

10

0f766c491e...63.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f766c491e3cc09ee834861e2a2eb85c20f3ef82faf709db776022df7e086363

  • Size

    100KB

  • Sample

    220212-hdnk3shbc6

  • MD5

    12e55708f058e6ba253c47ddc146a957

  • SHA1

    828238f430b020627457f5847c1ff286b65e3f4d

  • SHA256

    0f766c491e3cc09ee834861e2a2eb85c20f3ef82faf709db776022df7e086363

  • SHA512

    b8cac2025d4fcbca25e45af8ec07187ef22cb4257d7169a9e3f874a970f62b4371841df881282a503eef7db9d73ec1e95605367e11616442eb484b8b24633f25

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f766c491e3cc09ee834861e2a2eb85c20f3ef82faf709db776022df7e086363

    • Size

      100KB

    • MD5

      12e55708f058e6ba253c47ddc146a957

    • SHA1

      828238f430b020627457f5847c1ff286b65e3f4d

    • SHA256

      0f766c491e3cc09ee834861e2a2eb85c20f3ef82faf709db776022df7e086363

    • SHA512

      b8cac2025d4fcbca25e45af8ec07187ef22cb4257d7169a9e3f874a970f62b4371841df881282a503eef7db9d73ec1e95605367e11616442eb484b8b24633f25

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks