Overview

overview

10

Static

static

10

0f58969717...1d.exe

windows7_x64

10

0f58969717...1d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f58969717090ee79335d5a2980809b8fe92496ea670870d9772515d7631551d

  • Size

    100KB

  • Sample

    220212-he4zfsagbn

  • MD5

    de2075121ce65f69ec4bd8f3845bb9d8

  • SHA1

    5d69285caeb9cf7c70314824037e5050313890ea

  • SHA256

    0f58969717090ee79335d5a2980809b8fe92496ea670870d9772515d7631551d

  • SHA512

    6a9809d70677fb82e331f97db4d8c0646ac4e16fee42fa8fdc6326af82b2843e0c9c115ceff400a3918da3ba2d10e49a84e925ae954efc6b1fa6ef88d1796bd2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f58969717090ee79335d5a2980809b8fe92496ea670870d9772515d7631551d

    • Size

      100KB

    • MD5

      de2075121ce65f69ec4bd8f3845bb9d8

    • SHA1

      5d69285caeb9cf7c70314824037e5050313890ea

    • SHA256

      0f58969717090ee79335d5a2980809b8fe92496ea670870d9772515d7631551d

    • SHA512

      6a9809d70677fb82e331f97db4d8c0646ac4e16fee42fa8fdc6326af82b2843e0c9c115ceff400a3918da3ba2d10e49a84e925ae954efc6b1fa6ef88d1796bd2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks