Overview

overview

10

Static

static

10

0f360f7d12...36.exe

windows7_x64

10

0f360f7d12...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f360f7d12817746588d6b501b6e286cb55153a7a5c7248408bd42f8cc901236

  • Size

    192KB

  • Sample

    220212-hgglyahbf7

  • MD5

    faf3978c06bb4a5b1707d4b55f5d5652

  • SHA1

    93b3cb88f445a55867676412e1b04ceddf99eca1

  • SHA256

    0f360f7d12817746588d6b501b6e286cb55153a7a5c7248408bd42f8cc901236

  • SHA512

    9cea974934c5482513470854ac66f0e9ff41677f0a5e19297221db767611887c8a22aaf4b371fca18dc97f7dc7ad803d7914169ee1b0d8f0aac8c0e2ff4763b6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f360f7d12817746588d6b501b6e286cb55153a7a5c7248408bd42f8cc901236

    • Size

      192KB

    • MD5

      faf3978c06bb4a5b1707d4b55f5d5652

    • SHA1

      93b3cb88f445a55867676412e1b04ceddf99eca1

    • SHA256

      0f360f7d12817746588d6b501b6e286cb55153a7a5c7248408bd42f8cc901236

    • SHA512

      9cea974934c5482513470854ac66f0e9ff41677f0a5e19297221db767611887c8a22aaf4b371fca18dc97f7dc7ad803d7914169ee1b0d8f0aac8c0e2ff4763b6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks