Overview

overview

10

Static

static

0f1dc02451...57.exe

windows7_x64

10

0f1dc02451...57.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f1dc02451cfae31955c635b6245ff0562f0b6c9129a0f006129b1ea4bb2d357

  • Size

    60KB

  • Sample

    220212-hg8qesagdn

  • MD5

    e19d6d72c383da5a1acd0326b4cd14d4

  • SHA1

    4733dc2ca25354d2cd680282ff2bc598ace94097

  • SHA256

    0f1dc02451cfae31955c635b6245ff0562f0b6c9129a0f006129b1ea4bb2d357

  • SHA512

    56fd7bf5cfee24586b9dc74fa91966ca835d80941e059958fc03645063b1c9e9de3ceef2fa3a5a5df09b429a75f6b30b3f13ae437f0871f00c8d18869c116284

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f1dc02451cfae31955c635b6245ff0562f0b6c9129a0f006129b1ea4bb2d357

    • Size

      60KB

    • MD5

      e19d6d72c383da5a1acd0326b4cd14d4

    • SHA1

      4733dc2ca25354d2cd680282ff2bc598ace94097

    • SHA256

      0f1dc02451cfae31955c635b6245ff0562f0b6c9129a0f006129b1ea4bb2d357

    • SHA512

      56fd7bf5cfee24586b9dc74fa91966ca835d80941e059958fc03645063b1c9e9de3ceef2fa3a5a5df09b429a75f6b30b3f13ae437f0871f00c8d18869c116284

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks