Overview

overview

10

Static

static

10

0b742c9065...e1.exe

windows7_x64

10

0b742c9065...e1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b742c90655464de926f6cd72a875b89e6f11350340ca63fd8872817595755e1

  • Size

    191KB

  • Sample

    220212-j493fahhh9

  • MD5

    8cc40fe7f09f962da711ada57bc8425a

  • SHA1

    aabbc9d125f180f3a8a72b5ac3e371e3867d99e4

  • SHA256

    0b742c90655464de926f6cd72a875b89e6f11350340ca63fd8872817595755e1

  • SHA512

    89ef5a0658cc22c4cada3f8a9c265c020e8310b0d2b030718c2c9f22ff7fd3a38b340bace5bc18583c3924a52a9a01b282b5f518441add46ecdb44997a18e4d2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b742c90655464de926f6cd72a875b89e6f11350340ca63fd8872817595755e1

    • Size

      191KB

    • MD5

      8cc40fe7f09f962da711ada57bc8425a

    • SHA1

      aabbc9d125f180f3a8a72b5ac3e371e3867d99e4

    • SHA256

      0b742c90655464de926f6cd72a875b89e6f11350340ca63fd8872817595755e1

    • SHA512

      89ef5a0658cc22c4cada3f8a9c265c020e8310b0d2b030718c2c9f22ff7fd3a38b340bace5bc18583c3924a52a9a01b282b5f518441add46ecdb44997a18e4d2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks