Overview

overview

10

Static

static

0b9a67d941...9d.exe

windows7_x64

10

0b9a67d941...9d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b9a67d9414ee48c5922ed89f601bf4b1eb8fef6588455559a3250193dd39b9d

  • Size

    58KB

  • Sample

    220212-j1593shhf4

  • MD5

    6ada4bf88c0e48cf5c07f619ed746cfa

  • SHA1

    841162b771d01d6519038f1f9b178c4fa559bb1e

  • SHA256

    0b9a67d9414ee48c5922ed89f601bf4b1eb8fef6588455559a3250193dd39b9d

  • SHA512

    8f67a8b89586f2590a39714995512140803a9b71b73da800c76c2df6fde68d115394371bbe488c6526e52917d99881cecbd3caabf68e136cd418f64d2e5e10c3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b9a67d9414ee48c5922ed89f601bf4b1eb8fef6588455559a3250193dd39b9d

    • Size

      58KB

    • MD5

      6ada4bf88c0e48cf5c07f619ed746cfa

    • SHA1

      841162b771d01d6519038f1f9b178c4fa559bb1e

    • SHA256

      0b9a67d9414ee48c5922ed89f601bf4b1eb8fef6588455559a3250193dd39b9d

    • SHA512

      8f67a8b89586f2590a39714995512140803a9b71b73da800c76c2df6fde68d115394371bbe488c6526e52917d99881cecbd3caabf68e136cd418f64d2e5e10c3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks