Overview

overview

10

Static

static

10

0e473430b8...de.exe

windows7_x64

10

0e473430b8...de.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e473430b86f54580be946df125a7978d64a9595b28bc1c322a58d2945f8c5de

  • Size

    99KB

  • Sample

    220212-hzvaraahgj

  • MD5

    1622b6542c0714ffc316f63cc9e77816

  • SHA1

    6cf75017969d8cd695dfe97cdffa0f74bad8cc9e

  • SHA256

    0e473430b86f54580be946df125a7978d64a9595b28bc1c322a58d2945f8c5de

  • SHA512

    87a46b4a761b8160e88932fcd9c356f0228b0cbcf788c75ebf484e407ff4983c1c817bd49af6367303c00a1b7a3ea0bfecaf4c26d5592acf931bac9150d029fc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e473430b86f54580be946df125a7978d64a9595b28bc1c322a58d2945f8c5de

    • Size

      99KB

    • MD5

      1622b6542c0714ffc316f63cc9e77816

    • SHA1

      6cf75017969d8cd695dfe97cdffa0f74bad8cc9e

    • SHA256

      0e473430b86f54580be946df125a7978d64a9595b28bc1c322a58d2945f8c5de

    • SHA512

      87a46b4a761b8160e88932fcd9c356f0228b0cbcf788c75ebf484e407ff4983c1c817bd49af6367303c00a1b7a3ea0bfecaf4c26d5592acf931bac9150d029fc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks