Overview

overview

10

Static

static

0f6f663faa...1d.exe

windows7_x64

10

0f6f663faa...1d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f6f663faa36ba068313a86c443603d029dfedf05665e3a86b562cb4ef2baf1d

  • Size

    36KB

  • Sample

    220212-hdzy4sagam

  • MD5

    4c4fdb7fdf85cc55d2f4737aafa176db

  • SHA1

    52cb4c7b910ededd9b6ecc3bb420637cf701e125

  • SHA256

    0f6f663faa36ba068313a86c443603d029dfedf05665e3a86b562cb4ef2baf1d

  • SHA512

    2f0820c3a0f853f392de3e0cb0a4769c258bbb562f2bdd650a2f7063de6bc30d5128cd672e731ba0582251b929affa8169d3c30278797ec8b8ac26a40c11c6b0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f6f663faa36ba068313a86c443603d029dfedf05665e3a86b562cb4ef2baf1d

    • Size

      36KB

    • MD5

      4c4fdb7fdf85cc55d2f4737aafa176db

    • SHA1

      52cb4c7b910ededd9b6ecc3bb420637cf701e125

    • SHA256

      0f6f663faa36ba068313a86c443603d029dfedf05665e3a86b562cb4ef2baf1d

    • SHA512

      2f0820c3a0f853f392de3e0cb0a4769c258bbb562f2bdd650a2f7063de6bc30d5128cd672e731ba0582251b929affa8169d3c30278797ec8b8ac26a40c11c6b0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks