Overview

overview

10

Static

static

10

0eedf5fdf6...f1.exe

windows7_x64

10

0eedf5fdf6...f1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0eedf5fdf601a9f18bcab2c1a54c62229cd74ddab94d79ddcbca8e62444d18f1

  • Size

    216KB

  • Sample

    220212-hrekbshcb6

  • MD5

    cf6583b45257c00e866ce4a0bb493de4

  • SHA1

    964081d4edcb0759ef4835f3af2416c69c50ab0d

  • SHA256

    0eedf5fdf601a9f18bcab2c1a54c62229cd74ddab94d79ddcbca8e62444d18f1

  • SHA512

    a73971475309de421502341b1ce6446b4b737343e0c2be4557cec406f58644def19bc929058cb1740bc389a5d54435cce0c05c410ebeb62551d17a129e01e772

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0eedf5fdf601a9f18bcab2c1a54c62229cd74ddab94d79ddcbca8e62444d18f1

    • Size

      216KB

    • MD5

      cf6583b45257c00e866ce4a0bb493de4

    • SHA1

      964081d4edcb0759ef4835f3af2416c69c50ab0d

    • SHA256

      0eedf5fdf601a9f18bcab2c1a54c62229cd74ddab94d79ddcbca8e62444d18f1

    • SHA512

      a73971475309de421502341b1ce6446b4b737343e0c2be4557cec406f58644def19bc929058cb1740bc389a5d54435cce0c05c410ebeb62551d17a129e01e772

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks