Overview

overview

10

Static

static

10

0ef4502341...39.exe

windows7_x64

10

0ef4502341...39.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ef45023419b7aaad535bcba12d7a3f9dc3c2d14d3b994d6a9a74de7fc7e9d39

  • Size

    79KB

  • Sample

    220212-hqtmvshca8

  • MD5

    a0db87dc93ca75c219a006d49dd280c1

  • SHA1

    e46bea3ea77331489812d0f6ddf29a260ee8908f

  • SHA256

    0ef45023419b7aaad535bcba12d7a3f9dc3c2d14d3b994d6a9a74de7fc7e9d39

  • SHA512

    ece27033fb317da4cb890c3eaa39281652ef85ff62f8722852c066366b75387414c73ea92384ae4fd8e38ede45e1ce09b9e2c105852743bbfa5e4e3c2c697c75

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ef45023419b7aaad535bcba12d7a3f9dc3c2d14d3b994d6a9a74de7fc7e9d39

    • Size

      79KB

    • MD5

      a0db87dc93ca75c219a006d49dd280c1

    • SHA1

      e46bea3ea77331489812d0f6ddf29a260ee8908f

    • SHA256

      0ef45023419b7aaad535bcba12d7a3f9dc3c2d14d3b994d6a9a74de7fc7e9d39

    • SHA512

      ece27033fb317da4cb890c3eaa39281652ef85ff62f8722852c066366b75387414c73ea92384ae4fd8e38ede45e1ce09b9e2c105852743bbfa5e4e3c2c697c75

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks