Overview

overview

10

Static

static

10

0f56fc40e3...e1.exe

windows7_x64

10

0f56fc40e3...e1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f56fc40e36fcf3b6fbef42315c3c91f76b7e2f6ed6d089849a54694c6e9e3e1

  • Size

    101KB

  • Sample

    220212-hfbdjahbe4

  • MD5

    fd6633c46807bfe4822fff86fd5c8cbf

  • SHA1

    16312dbd0a25d2dc345f7acd3eec67cdb8385bc2

  • SHA256

    0f56fc40e36fcf3b6fbef42315c3c91f76b7e2f6ed6d089849a54694c6e9e3e1

  • SHA512

    d5fa2d054f73265081f1ecc7432f6f52c1f737ca3287f418828ee676829b960a681c5b67db20487eaa1e10e4db44aea185c6ed638b438ccddd1a7e3f6ece7bbb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f56fc40e36fcf3b6fbef42315c3c91f76b7e2f6ed6d089849a54694c6e9e3e1

    • Size

      101KB

    • MD5

      fd6633c46807bfe4822fff86fd5c8cbf

    • SHA1

      16312dbd0a25d2dc345f7acd3eec67cdb8385bc2

    • SHA256

      0f56fc40e36fcf3b6fbef42315c3c91f76b7e2f6ed6d089849a54694c6e9e3e1

    • SHA512

      d5fa2d054f73265081f1ecc7432f6f52c1f737ca3287f418828ee676829b960a681c5b67db20487eaa1e10e4db44aea185c6ed638b438ccddd1a7e3f6ece7bbb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks