Overview

overview

10

Static

static

10

0b5f7e9321...47.exe

windows7_x64

10

0b5f7e9321...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547

  • Size

    80KB

  • Sample

    220212-j6byesaab4

  • MD5

    cceca84e4d9259ef5d7c011635c47d5e

  • SHA1

    5619e55c8b7f1b6c5760995066c0bea5375dde20

  • SHA256

    0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547

  • SHA512

    42e42195d7cfc0dffe46ef80d8bf0bebbf720fa0f3acc1d2acee47f1162208b72869e1fd0118572e1b33f427b06000c55a4bb5e0a1a013bcbd397e968481caed

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547

    • Size

      80KB

    • MD5

      cceca84e4d9259ef5d7c011635c47d5e

    • SHA1

      5619e55c8b7f1b6c5760995066c0bea5375dde20

    • SHA256

      0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547

    • SHA512

      42e42195d7cfc0dffe46ef80d8bf0bebbf720fa0f3acc1d2acee47f1162208b72869e1fd0118572e1b33f427b06000c55a4bb5e0a1a013bcbd397e968481caed

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks