Overview

overview

10

Static

static

10

0b4fe77e6f...9c.exe

windows7_x64

10

0b4fe77e6f...9c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b4fe77e6f8f37e2e5f9f4b9db2e7ab41e7c489d201547354269f2a9d0a5b19c

  • Size

    80KB

  • Sample

    220212-j649zaaac3

  • MD5

    b611c7623faee5bf85dde7e54fe79415

  • SHA1

    3a348502ed33e5e1531373982efb20b708cc0fd1

  • SHA256

    0b4fe77e6f8f37e2e5f9f4b9db2e7ab41e7c489d201547354269f2a9d0a5b19c

  • SHA512

    64ab31bff528d48fb7f9ef06597b7f6c50e7c1c2a39c05fe888c567b35a3015e973f2bd26a7e17f6ea810c51b5742ab6ee444fcf79123fdfff72aed7cd9a232a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b4fe77e6f8f37e2e5f9f4b9db2e7ab41e7c489d201547354269f2a9d0a5b19c

    • Size

      80KB

    • MD5

      b611c7623faee5bf85dde7e54fe79415

    • SHA1

      3a348502ed33e5e1531373982efb20b708cc0fd1

    • SHA256

      0b4fe77e6f8f37e2e5f9f4b9db2e7ab41e7c489d201547354269f2a9d0a5b19c

    • SHA512

      64ab31bff528d48fb7f9ef06597b7f6c50e7c1c2a39c05fe888c567b35a3015e973f2bd26a7e17f6ea810c51b5742ab6ee444fcf79123fdfff72aed7cd9a232a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks