Overview

overview

10

Static

static

10

0f2a84ea0a...e0.exe

windows7_x64

10

0f2a84ea0a...e0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f2a84ea0aa829e7b3fba3eafa2a1b8e425546f0d85fdd217f86ed7b8ed6a0e0

  • Size

    80KB

  • Sample

    220212-hgxcdsagcr

  • MD5

    1612865fe47c9e00127acceafa3536a5

  • SHA1

    ee68a7558d4b00db8f596add181472ec86e02a20

  • SHA256

    0f2a84ea0aa829e7b3fba3eafa2a1b8e425546f0d85fdd217f86ed7b8ed6a0e0

  • SHA512

    d2ebfae0f971ec01b62f8a18e41d81c73c93910dd19dfb7d607e7d4271016578a037202cac5c6abd7737e3d49666e4971d7348edb3714182ec38dccf192455dd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f2a84ea0aa829e7b3fba3eafa2a1b8e425546f0d85fdd217f86ed7b8ed6a0e0

    • Size

      80KB

    • MD5

      1612865fe47c9e00127acceafa3536a5

    • SHA1

      ee68a7558d4b00db8f596add181472ec86e02a20

    • SHA256

      0f2a84ea0aa829e7b3fba3eafa2a1b8e425546f0d85fdd217f86ed7b8ed6a0e0

    • SHA512

      d2ebfae0f971ec01b62f8a18e41d81c73c93910dd19dfb7d607e7d4271016578a037202cac5c6abd7737e3d49666e4971d7348edb3714182ec38dccf192455dd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks