Overview

overview

10

Static

static

0f71c84d71...89.exe

windows7_x64

10

0f71c84d71...89.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f71c84d712f9e8c2b58a2c91fb9f142f1bbad147efd49eb05c385686aeb4689

  • Size

    60KB

  • Sample

    220212-hdx5hsagal

  • MD5

    1eeac55938cf588a90c352f3c5143f3b

  • SHA1

    ff3005979f2f6abe98be0f448706ae07527fe307

  • SHA256

    0f71c84d712f9e8c2b58a2c91fb9f142f1bbad147efd49eb05c385686aeb4689

  • SHA512

    2c53fa1f4f27cab5007c79e92e30ed7ea3ea8b6d2ba5831104b2f6919c5f96cfeb3fecd4fc35d97757a9b3a5a7ffbf2ed6d82fe91254031902e2f24d9f6455ab

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f71c84d712f9e8c2b58a2c91fb9f142f1bbad147efd49eb05c385686aeb4689

    • Size

      60KB

    • MD5

      1eeac55938cf588a90c352f3c5143f3b

    • SHA1

      ff3005979f2f6abe98be0f448706ae07527fe307

    • SHA256

      0f71c84d712f9e8c2b58a2c91fb9f142f1bbad147efd49eb05c385686aeb4689

    • SHA512

      2c53fa1f4f27cab5007c79e92e30ed7ea3ea8b6d2ba5831104b2f6919c5f96cfeb3fecd4fc35d97757a9b3a5a7ffbf2ed6d82fe91254031902e2f24d9f6455ab

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks