Overview

overview

10

Static

static

10

0f7280cfdd...09.exe

windows7_x64

10

0f7280cfdd...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f7280cfddd81ed7ef44743a10a967494f0e5f06bb4b8bfdd3d528d167340809

  • Size

    150KB

  • Sample

    220212-hdvz6ahbc8

  • MD5

    deae9935199750583d3343c83b0a5f2b

  • SHA1

    0c7284e51363b23adb5e805fd2eeda52ff9b225f

  • SHA256

    0f7280cfddd81ed7ef44743a10a967494f0e5f06bb4b8bfdd3d528d167340809

  • SHA512

    9b88510981a77dcd0f4823c42fde0ef4971528e8ff8fa0ba0c22823c32315388fa27855c4db918fcdde8ac00f1cf8f6bfed70c44348ababb46a828c64a351892

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f7280cfddd81ed7ef44743a10a967494f0e5f06bb4b8bfdd3d528d167340809

    • Size

      150KB

    • MD5

      deae9935199750583d3343c83b0a5f2b

    • SHA1

      0c7284e51363b23adb5e805fd2eeda52ff9b225f

    • SHA256

      0f7280cfddd81ed7ef44743a10a967494f0e5f06bb4b8bfdd3d528d167340809

    • SHA512

      9b88510981a77dcd0f4823c42fde0ef4971528e8ff8fa0ba0c22823c32315388fa27855c4db918fcdde8ac00f1cf8f6bfed70c44348ababb46a828c64a351892

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks