Overview

overview

10

Static

static

10

0ea10183a6...43.exe

windows7_x64

10

0ea10183a6...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ea10183a6ddab052653cfb8e7333db0a304eadb58ed0e4ac43e3449c32df743

  • Size

    88KB

  • Sample

    220212-hv3rbsahbk

  • MD5

    d76435a802d73c21600b1d1f7389f183

  • SHA1

    a513104ecf0e4fcecd20966ded939b83e843a253

  • SHA256

    0ea10183a6ddab052653cfb8e7333db0a304eadb58ed0e4ac43e3449c32df743

  • SHA512

    ccf30470ea0dfaf4c0dc25e7e7571c57dd5693bde1ef5f0c843024140e811f885c63c8f5f48efaaffbcffea128933a553a9d1047c8f84a8c22b2b12360d00fe9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ea10183a6ddab052653cfb8e7333db0a304eadb58ed0e4ac43e3449c32df743

    • Size

      88KB

    • MD5

      d76435a802d73c21600b1d1f7389f183

    • SHA1

      a513104ecf0e4fcecd20966ded939b83e843a253

    • SHA256

      0ea10183a6ddab052653cfb8e7333db0a304eadb58ed0e4ac43e3449c32df743

    • SHA512

      ccf30470ea0dfaf4c0dc25e7e7571c57dd5693bde1ef5f0c843024140e811f885c63c8f5f48efaaffbcffea128933a553a9d1047c8f84a8c22b2b12360d00fe9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks