Overview

overview

10

Static

static

0f08a7068f...44.exe

windows7_x64

10

0f08a7068f...44.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f08a7068f8b16729c5f64b8e0c1471c75cadfc74bad8cecd2ffce92af38df44

  • Size

    58KB

  • Sample

    220212-hjd9lahbh7

  • MD5

    e2b1688f3b476f22dc4a68e6657fb8a5

  • SHA1

    686d4394a1f8041e7da56e12745bda18fff4a437

  • SHA256

    0f08a7068f8b16729c5f64b8e0c1471c75cadfc74bad8cecd2ffce92af38df44

  • SHA512

    0d8cd4c193d8487beb24420ee3a839538b296c03fa60bf548d1215a88da970a5ab309a1875c8ec3d44415b4cd974a24f007108715405f7b4a99805223dfc06f1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0f08a7068f8b16729c5f64b8e0c1471c75cadfc74bad8cecd2ffce92af38df44

    • Size

      58KB

    • MD5

      e2b1688f3b476f22dc4a68e6657fb8a5

    • SHA1

      686d4394a1f8041e7da56e12745bda18fff4a437

    • SHA256

      0f08a7068f8b16729c5f64b8e0c1471c75cadfc74bad8cecd2ffce92af38df44

    • SHA512

      0d8cd4c193d8487beb24420ee3a839538b296c03fa60bf548d1215a88da970a5ab309a1875c8ec3d44415b4cd974a24f007108715405f7b4a99805223dfc06f1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks