Overview

overview

10

Static

static

0b78ab5f8c...41.exe

windows7_x64

10

0b78ab5f8c...41.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41

  • Size

    58KB

  • Sample

    220212-j4lpvabefn

  • MD5

    fc3cab6d5c326d21e033e3f5e72b80ec

  • SHA1

    76043dfc52d0aeb4f7241a38a546833711ab7be2

  • SHA256

    0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41

  • SHA512

    3ce391fad344da18661ea0db55742c33e47aec180fc1086848124608d05cd11afbda7747f1d50758dd74319884c60e945458cd33826e732f1d289cfa356e17d5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41

    • Size

      58KB

    • MD5

      fc3cab6d5c326d21e033e3f5e72b80ec

    • SHA1

      76043dfc52d0aeb4f7241a38a546833711ab7be2

    • SHA256

      0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41

    • SHA512

      3ce391fad344da18661ea0db55742c33e47aec180fc1086848124608d05cd11afbda7747f1d50758dd74319884c60e945458cd33826e732f1d289cfa356e17d5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks