Overview

overview

10

Static

static

10

0ba1ed465a...cd.exe

windows7_x64

10

0ba1ed465a...cd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ba1ed465a2c9e18ec05d33d7ab7da442487facfd5ed2addaa762b0c1251fccd

  • Size

    101KB

  • Sample

    220212-j1h5jshhe6

  • MD5

    ca318c838cd1c3c6a2ddf3abc538b652

  • SHA1

    13a91edaf4f5727c5f5fa4277b4041e7110bd8fa

  • SHA256

    0ba1ed465a2c9e18ec05d33d7ab7da442487facfd5ed2addaa762b0c1251fccd

  • SHA512

    92ff016c800290cedca1cc2d0168520120d7277d357b37f9df07e3b73440ccaec9d11406286c99116c5cda6669d25a30cea118ea580685bebd6fac70e9a0fea9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ba1ed465a2c9e18ec05d33d7ab7da442487facfd5ed2addaa762b0c1251fccd

    • Size

      101KB

    • MD5

      ca318c838cd1c3c6a2ddf3abc538b652

    • SHA1

      13a91edaf4f5727c5f5fa4277b4041e7110bd8fa

    • SHA256

      0ba1ed465a2c9e18ec05d33d7ab7da442487facfd5ed2addaa762b0c1251fccd

    • SHA512

      92ff016c800290cedca1cc2d0168520120d7277d357b37f9df07e3b73440ccaec9d11406286c99116c5cda6669d25a30cea118ea580685bebd6fac70e9a0fea9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks