Overview

overview

10

Static

static

10

0eed96a0f3...a2.exe

windows7_x64

10

0eed96a0f3...a2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0eed96a0f3a9ffed663c3fa9b5e95f2b2ac94cd0578dc85f24849a6e0aed72a2

  • Size

    80KB

  • Sample

    220212-hrlnmsaggm

  • MD5

    7220ba754a8ac623be4fca61f41a7c19

  • SHA1

    2092a46efe36af5ff4b924c75a50a0c2245da00f

  • SHA256

    0eed96a0f3a9ffed663c3fa9b5e95f2b2ac94cd0578dc85f24849a6e0aed72a2

  • SHA512

    bdfeb83726a16f79485fd9399ec7e7979befb414faaf5182c56f32d87f14b9549cf9ecdea009d718917fa013776241ef1ef2fe3fd241d1d6eaa049d85b772d53

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0eed96a0f3a9ffed663c3fa9b5e95f2b2ac94cd0578dc85f24849a6e0aed72a2

    • Size

      80KB

    • MD5

      7220ba754a8ac623be4fca61f41a7c19

    • SHA1

      2092a46efe36af5ff4b924c75a50a0c2245da00f

    • SHA256

      0eed96a0f3a9ffed663c3fa9b5e95f2b2ac94cd0578dc85f24849a6e0aed72a2

    • SHA512

      bdfeb83726a16f79485fd9399ec7e7979befb414faaf5182c56f32d87f14b9549cf9ecdea009d718917fa013776241ef1ef2fe3fd241d1d6eaa049d85b772d53

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks