Overview

overview

10

Static

static

10

0f0999200f...68.exe

windows7_x64

10

0f0999200f...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f0999200fc6e1f2f2e22886e2acea37dd38d8c5ef13dc5ab6c0865383b44968

  • Size

    150KB

  • Sample

    220212-hh8f2shbh4

  • MD5

    27e3db657f8c9b11b86df7d5ae7732fb

  • SHA1

    c48a4c857de355db80ed2ff659152bdd3f58d82a

  • SHA256

    0f0999200fc6e1f2f2e22886e2acea37dd38d8c5ef13dc5ab6c0865383b44968

  • SHA512

    1e9b8cf861c144815fb72b79aa0cf581544d788707109b0360dd9c8811b30a37de803b25774da5d1197f03fe175652a8ae627b6ebdb25d838de8c1e9349173b7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f0999200fc6e1f2f2e22886e2acea37dd38d8c5ef13dc5ab6c0865383b44968

    • Size

      150KB

    • MD5

      27e3db657f8c9b11b86df7d5ae7732fb

    • SHA1

      c48a4c857de355db80ed2ff659152bdd3f58d82a

    • SHA256

      0f0999200fc6e1f2f2e22886e2acea37dd38d8c5ef13dc5ab6c0865383b44968

    • SHA512

      1e9b8cf861c144815fb72b79aa0cf581544d788707109b0360dd9c8811b30a37de803b25774da5d1197f03fe175652a8ae627b6ebdb25d838de8c1e9349173b7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks