Overview

overview

10

Static

static

10

0ec94ad92b...cd.exe

windows7_x64

10

0ec94ad92b...cd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ec94ad92ba4e712c73cc638f721502b7f53b1a12a150c9f2a18ba69c6be66cd

  • Size

    192KB

  • Sample

    220212-htn7jshcd8

  • MD5

    f8a5de64f90046e73eeaf68b1bbf9bd2

  • SHA1

    40ba2708e5589145b29af0fd95cb5ef0c25522d3

  • SHA256

    0ec94ad92ba4e712c73cc638f721502b7f53b1a12a150c9f2a18ba69c6be66cd

  • SHA512

    1efbb628a9bf8c1f1a4facb29d0a8d87bc2225edfef2f94b521f33ef12860a7ca6b73d751792729d17841d6c8c6066392303b45eb5cf26f33a1af52612e3b500

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ec94ad92ba4e712c73cc638f721502b7f53b1a12a150c9f2a18ba69c6be66cd

    • Size

      192KB

    • MD5

      f8a5de64f90046e73eeaf68b1bbf9bd2

    • SHA1

      40ba2708e5589145b29af0fd95cb5ef0c25522d3

    • SHA256

      0ec94ad92ba4e712c73cc638f721502b7f53b1a12a150c9f2a18ba69c6be66cd

    • SHA512

      1efbb628a9bf8c1f1a4facb29d0a8d87bc2225edfef2f94b521f33ef12860a7ca6b73d751792729d17841d6c8c6066392303b45eb5cf26f33a1af52612e3b500

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks