Overview

overview

10

Static

static

10

0edcd4cbfd...8d.exe

windows7_x64

10

0edcd4cbfd...8d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0edcd4cbfd6523545150203fd066e8300c3d99e53f92bf9eebb6d5d448da048d

  • Size

    216KB

  • Sample

    220212-hsnvdshcc7

  • MD5

    cad34a102d701db124aba8985acf9c2e

  • SHA1

    17da334a45b761d6e71ca068addaee46b32a4eb5

  • SHA256

    0edcd4cbfd6523545150203fd066e8300c3d99e53f92bf9eebb6d5d448da048d

  • SHA512

    7d46e93b217dc5027ecd854df01fd5956ae825a6f6d737918d8bd3e2d8e3f085465720bf8b8faae9f8649373b56ebb2eec52580210cd74f3753b0bc74aff97a3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0edcd4cbfd6523545150203fd066e8300c3d99e53f92bf9eebb6d5d448da048d

    • Size

      216KB

    • MD5

      cad34a102d701db124aba8985acf9c2e

    • SHA1

      17da334a45b761d6e71ca068addaee46b32a4eb5

    • SHA256

      0edcd4cbfd6523545150203fd066e8300c3d99e53f92bf9eebb6d5d448da048d

    • SHA512

      7d46e93b217dc5027ecd854df01fd5956ae825a6f6d737918d8bd3e2d8e3f085465720bf8b8faae9f8649373b56ebb2eec52580210cd74f3753b0bc74aff97a3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks