Overview

overview

10

Static

static

0e88098da7...fb.exe

windows7_x64

10

0e88098da7...fb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e88098da7ab53854b318f4733de4345bec6e0057c26a8ec317cd324e869a8fb

  • Size

    58KB

  • Sample

    220212-hxj21aahdk

  • MD5

    1e425867606ab3005647a7cb81c6029d

  • SHA1

    9b3594078c4fff01bc1c8d46d1e662e9e05da396

  • SHA256

    0e88098da7ab53854b318f4733de4345bec6e0057c26a8ec317cd324e869a8fb

  • SHA512

    70035e12ea973b26b7bb82bb0c919cac7e7f86e3788666fff5e3bf8fea96a74b46c3833523edbb1ea750dbbfbd47832feaae9727bd378ac8a2e5f709dd00ca75

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e88098da7ab53854b318f4733de4345bec6e0057c26a8ec317cd324e869a8fb

    • Size

      58KB

    • MD5

      1e425867606ab3005647a7cb81c6029d

    • SHA1

      9b3594078c4fff01bc1c8d46d1e662e9e05da396

    • SHA256

      0e88098da7ab53854b318f4733de4345bec6e0057c26a8ec317cd324e869a8fb

    • SHA512

      70035e12ea973b26b7bb82bb0c919cac7e7f86e3788666fff5e3bf8fea96a74b46c3833523edbb1ea750dbbfbd47832feaae9727bd378ac8a2e5f709dd00ca75

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks