Overview

overview

10

Static

static

10

0e7b996f4e...8c.exe

windows7_x64

10

0e7b996f4e...8c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e7b996f4e71a3bd03ee9c3a38f1bf2f84e94b97b13d8ae917e35f3683689a8c

  • Size

    104KB

  • Sample

    220212-hxtanshch4

  • MD5

    1f7c71f8b36260cd9b07c3ca7813c484

  • SHA1

    d2789e5712b9cb85ac58a94de4aa74a25b47359c

  • SHA256

    0e7b996f4e71a3bd03ee9c3a38f1bf2f84e94b97b13d8ae917e35f3683689a8c

  • SHA512

    cc7794aabddff4d57951e78569d6e547073f1dcbe61ab33d51b8a7696eeafb13bf796206f989df60d016af78b5fede1305953be405c77240b1ba05c738afa9c5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e7b996f4e71a3bd03ee9c3a38f1bf2f84e94b97b13d8ae917e35f3683689a8c

    • Size

      104KB

    • MD5

      1f7c71f8b36260cd9b07c3ca7813c484

    • SHA1

      d2789e5712b9cb85ac58a94de4aa74a25b47359c

    • SHA256

      0e7b996f4e71a3bd03ee9c3a38f1bf2f84e94b97b13d8ae917e35f3683689a8c

    • SHA512

      cc7794aabddff4d57951e78569d6e547073f1dcbe61ab33d51b8a7696eeafb13bf796206f989df60d016af78b5fede1305953be405c77240b1ba05c738afa9c5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks