Overview

overview

10

Static

static

10

0e60afeb4a...c0.exe

windows7_x64

10

0e60afeb4a...c0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e60afeb4a0d9e0dda8acb26d462d490d2225dcb8dd362c0978c0d8205e23ec0

  • Size

    79KB

  • Sample

    220212-hy51vshda5

  • MD5

    dd550af6c00456139fd73bbded2d0300

  • SHA1

    140f2054f74ae646a01021ccc727a7270cc14e46

  • SHA256

    0e60afeb4a0d9e0dda8acb26d462d490d2225dcb8dd362c0978c0d8205e23ec0

  • SHA512

    2f8b784747ecdbf7aa333cf72fce563377ba4013b3a73179d9e882fddabe2e8648cc5ea6c3d1b3ad332626507e5297972c16bd1421a4bdf46338947d1e2c379d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e60afeb4a0d9e0dda8acb26d462d490d2225dcb8dd362c0978c0d8205e23ec0

    • Size

      79KB

    • MD5

      dd550af6c00456139fd73bbded2d0300

    • SHA1

      140f2054f74ae646a01021ccc727a7270cc14e46

    • SHA256

      0e60afeb4a0d9e0dda8acb26d462d490d2225dcb8dd362c0978c0d8205e23ec0

    • SHA512

      2f8b784747ecdbf7aa333cf72fce563377ba4013b3a73179d9e882fddabe2e8648cc5ea6c3d1b3ad332626507e5297972c16bd1421a4bdf46338947d1e2c379d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks