Overview

overview

10

Static

static

0ee7935e8c...f6.exe

windows7_x64

10

0ee7935e8c...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ee7935e8c65facc588d4630cfb26a2b12780ebe43766ff016d3792010502cf6

  • Size

    36KB

  • Sample

    220212-hrycfahcc2

  • MD5

    f4684f1bbd3fd5fb7325952e18cbcb78

  • SHA1

    ae86ae0f854d3127a24c4dd10e6d9c14e9aeea34

  • SHA256

    0ee7935e8c65facc588d4630cfb26a2b12780ebe43766ff016d3792010502cf6

  • SHA512

    7e5f4461c83b43cae725ed2886a62afc8fd70d43081b8df40477c0036929a8e765980f6948df23a4b290945f0f6eec6f36511aa4ee81799cc5fb98bf837d9586

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ee7935e8c65facc588d4630cfb26a2b12780ebe43766ff016d3792010502cf6

    • Size

      36KB

    • MD5

      f4684f1bbd3fd5fb7325952e18cbcb78

    • SHA1

      ae86ae0f854d3127a24c4dd10e6d9c14e9aeea34

    • SHA256

      0ee7935e8c65facc588d4630cfb26a2b12780ebe43766ff016d3792010502cf6

    • SHA512

      7e5f4461c83b43cae725ed2886a62afc8fd70d43081b8df40477c0036929a8e765980f6948df23a4b290945f0f6eec6f36511aa4ee81799cc5fb98bf837d9586

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks