Overview

overview

10

Static

static

10

0e9eb49072...75.exe

windows7_x64

10

0e9eb49072...75.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e9eb49072f05b77e112712efbe30886e24e4aba4914bb731c11a4c22a4f2d75

  • Size

    168KB

  • Sample

    220212-hv9vmshcg2

  • MD5

    c087e9fb99bfbd690dc6e186bbf91fda

  • SHA1

    f71ad568b86497171092abdfae77cff25b161f5d

  • SHA256

    0e9eb49072f05b77e112712efbe30886e24e4aba4914bb731c11a4c22a4f2d75

  • SHA512

    e16a2f38e682d12ecf1a142497f18dc32420f3de6161241a802f46f3a6b72e1cedab4e35b981d2e6cb5516194fe2b54b535fb9f9d5abb6ea23717b7b50713cf6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e9eb49072f05b77e112712efbe30886e24e4aba4914bb731c11a4c22a4f2d75

    • Size

      168KB

    • MD5

      c087e9fb99bfbd690dc6e186bbf91fda

    • SHA1

      f71ad568b86497171092abdfae77cff25b161f5d

    • SHA256

      0e9eb49072f05b77e112712efbe30886e24e4aba4914bb731c11a4c22a4f2d75

    • SHA512

      e16a2f38e682d12ecf1a142497f18dc32420f3de6161241a802f46f3a6b72e1cedab4e35b981d2e6cb5516194fe2b54b535fb9f9d5abb6ea23717b7b50713cf6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks