Overview

overview

10

Static

static

0f2e2d7651...01.exe

windows7_x64

10

0f2e2d7651...01.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f2e2d76510cf8f0801832d04aa1f384a23b6da8c9ba3d27c450eb7a86bdbe01

  • Size

    58KB

  • Sample

    220212-hgsdfaagcq

  • MD5

    9dc85ad921fac13d4b28958fdea8f95e

  • SHA1

    c70d1277fa130adae21f0581112391843c6b8e65

  • SHA256

    0f2e2d76510cf8f0801832d04aa1f384a23b6da8c9ba3d27c450eb7a86bdbe01

  • SHA512

    a6644ee7227e22230bae92a34a0fc096aaa103fcd636004a5847b5c8f139186f3be8a47545b9e15fb3c337165b606e0c2d270333bac074ad8b5224218e7f28c5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f2e2d76510cf8f0801832d04aa1f384a23b6da8c9ba3d27c450eb7a86bdbe01

    • Size

      58KB

    • MD5

      9dc85ad921fac13d4b28958fdea8f95e

    • SHA1

      c70d1277fa130adae21f0581112391843c6b8e65

    • SHA256

      0f2e2d76510cf8f0801832d04aa1f384a23b6da8c9ba3d27c450eb7a86bdbe01

    • SHA512

      a6644ee7227e22230bae92a34a0fc096aaa103fcd636004a5847b5c8f139186f3be8a47545b9e15fb3c337165b606e0c2d270333bac074ad8b5224218e7f28c5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks