Overview

overview

10

Static

static

10

0f2cc9a87e...de.exe

windows7_x64

10

0f2cc9a87e...de.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f2cc9a87ef715c4f456463fddaedfda931b205bf0331aab007790d1bd2c3ade

  • Size

    80KB

  • Sample

    220212-hgvhsshbg3

  • MD5

    fcbc0b32c4113122ea24e3d862137273

  • SHA1

    f715b292a1093fbb0adfb9aa572ef94469feeb75

  • SHA256

    0f2cc9a87ef715c4f456463fddaedfda931b205bf0331aab007790d1bd2c3ade

  • SHA512

    a8cbc85bfd58598ad27f96c533c4e9c417eaaf99bebe9127b953a7ac75fb80794ba88bf863b775730806a4f5908ac9b007471ac91172bc2243584db49f9fc5df

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f2cc9a87ef715c4f456463fddaedfda931b205bf0331aab007790d1bd2c3ade

    • Size

      80KB

    • MD5

      fcbc0b32c4113122ea24e3d862137273

    • SHA1

      f715b292a1093fbb0adfb9aa572ef94469feeb75

    • SHA256

      0f2cc9a87ef715c4f456463fddaedfda931b205bf0331aab007790d1bd2c3ade

    • SHA512

      a8cbc85bfd58598ad27f96c533c4e9c417eaaf99bebe9127b953a7ac75fb80794ba88bf863b775730806a4f5908ac9b007471ac91172bc2243584db49f9fc5df

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks