Overview

overview

10

Static

static

10

0eb1131c4b...ed.exe

windows7_x64

10

0eb1131c4b...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0eb1131c4b39e1baa0b0d8ba7241f6b0dd6211720f5e5b47990d626be13983ed

  • Size

    216KB

  • Sample

    220212-hvjcpahcf3

  • MD5

    5dd5713184d23353c810afc5cce3f411

  • SHA1

    7fbe65c735240811c0659f0ea4454fec318ea1cd

  • SHA256

    0eb1131c4b39e1baa0b0d8ba7241f6b0dd6211720f5e5b47990d626be13983ed

  • SHA512

    dce49e758b0b2a95b423dc2ba4bf59d5b431f0631e4846d2288f69a7e7064fe8455e6aef734c5b191363f1be01b99837ac65cc0f047b4b304cd81f7d04340dff

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0eb1131c4b39e1baa0b0d8ba7241f6b0dd6211720f5e5b47990d626be13983ed

    • Size

      216KB

    • MD5

      5dd5713184d23353c810afc5cce3f411

    • SHA1

      7fbe65c735240811c0659f0ea4454fec318ea1cd

    • SHA256

      0eb1131c4b39e1baa0b0d8ba7241f6b0dd6211720f5e5b47990d626be13983ed

    • SHA512

      dce49e758b0b2a95b423dc2ba4bf59d5b431f0631e4846d2288f69a7e7064fe8455e6aef734c5b191363f1be01b99837ac65cc0f047b4b304cd81f7d04340dff

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks