Overview

overview

10

Static

static

0f12374a44...d9.exe

windows7_x64

10

0f12374a44...d9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f12374a44a3f27f5999149c608bf121027d64dcc54fd73552f6888d65304ed9

  • Size

    35KB

  • Sample

    220212-hhpzpsagej

  • MD5

    b15e6b2f0a0108617f4c67d38bb4189c

  • SHA1

    8e1a5e14c0e96d82be1e53b00c8e94bc513e0b65

  • SHA256

    0f12374a44a3f27f5999149c608bf121027d64dcc54fd73552f6888d65304ed9

  • SHA512

    84623967764d10af9319ab1d535d68829230640faf97ad8948edc46a1d1e7b854840ca03326300f99fc437d6862e7322ba60c6f7c6aa868eccc6918a618dbe44

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f12374a44a3f27f5999149c608bf121027d64dcc54fd73552f6888d65304ed9

    • Size

      35KB

    • MD5

      b15e6b2f0a0108617f4c67d38bb4189c

    • SHA1

      8e1a5e14c0e96d82be1e53b00c8e94bc513e0b65

    • SHA256

      0f12374a44a3f27f5999149c608bf121027d64dcc54fd73552f6888d65304ed9

    • SHA512

      84623967764d10af9319ab1d535d68829230640faf97ad8948edc46a1d1e7b854840ca03326300f99fc437d6862e7322ba60c6f7c6aa868eccc6918a618dbe44

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks