Overview

overview

10

Static

static

10

0f26ef8ce7...c6.exe

windows7_x64

10

0f26ef8ce7...c6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f26ef8ce7234c4ff466ef2b1bba8d9ca4ede577756e0778e160170aa0abb4c6

  • Size

    99KB

  • Sample

    220212-hg2l4sagdl

  • MD5

    b009a847dfecc73d47041b15c45720d0

  • SHA1

    0541824dbbcdade28974cc9abb35b6a7074aca54

  • SHA256

    0f26ef8ce7234c4ff466ef2b1bba8d9ca4ede577756e0778e160170aa0abb4c6

  • SHA512

    17f16077d84098781ce3744b691da6be19000a639cb28e75ea5293d52bf1f912731cfe8d82cc80b6fb48b94091df356d348c0fd0134741c95a44b4d2548eaedf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f26ef8ce7234c4ff466ef2b1bba8d9ca4ede577756e0778e160170aa0abb4c6

    • Size

      99KB

    • MD5

      b009a847dfecc73d47041b15c45720d0

    • SHA1

      0541824dbbcdade28974cc9abb35b6a7074aca54

    • SHA256

      0f26ef8ce7234c4ff466ef2b1bba8d9ca4ede577756e0778e160170aa0abb4c6

    • SHA512

      17f16077d84098781ce3744b691da6be19000a639cb28e75ea5293d52bf1f912731cfe8d82cc80b6fb48b94091df356d348c0fd0134741c95a44b4d2548eaedf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks