Overview

overview

10

Static

static

0ecfa46452...1d.exe

windows7_x64

10

0ecfa46452...1d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ecfa46452c098c6aa6a464b1b4364f601e8abf8bcab361323e08c74dc7c901d

  • Size

    58KB

  • Sample

    220212-htan6aahak

  • MD5

    06f74bf4f7a28d2b670e43b195782226

  • SHA1

    c0d360829b3645fad12c30fae11bdcd6f90d4bd7

  • SHA256

    0ecfa46452c098c6aa6a464b1b4364f601e8abf8bcab361323e08c74dc7c901d

  • SHA512

    1585bdd5686b13cd02e9b8035724888b4695a25e110f8c124884fd0937acdd1f9aed236540dab465873225071b32ef662589e99626114abba9699ecb40a2d06b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ecfa46452c098c6aa6a464b1b4364f601e8abf8bcab361323e08c74dc7c901d

    • Size

      58KB

    • MD5

      06f74bf4f7a28d2b670e43b195782226

    • SHA1

      c0d360829b3645fad12c30fae11bdcd6f90d4bd7

    • SHA256

      0ecfa46452c098c6aa6a464b1b4364f601e8abf8bcab361323e08c74dc7c901d

    • SHA512

      1585bdd5686b13cd02e9b8035724888b4695a25e110f8c124884fd0937acdd1f9aed236540dab465873225071b32ef662589e99626114abba9699ecb40a2d06b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks