Overview

overview

10

Static

static

10

0b4e2819e4...16.exe

windows7_x64

10

0b4e2819e4...16.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b4e2819e4aa5a3129586366dcb718a474e5900c28bac3effed674ecda7eec16

  • Size

    99KB

  • Sample

    220212-j7m23sbfal

  • MD5

    c2f9be4ef7e6aa0992f983ca420bf819

  • SHA1

    f035f6ffd7f22a14ae1c1c237f7a6602649f973f

  • SHA256

    0b4e2819e4aa5a3129586366dcb718a474e5900c28bac3effed674ecda7eec16

  • SHA512

    4424d75dff8293a491a3b5ec6d987e501c1e005d5d4af0561f67b59eedb8a3ee61cbd4a676211ca5bf9830cf20ccd3f235351570b9cc6284073a4a984a7d50e8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b4e2819e4aa5a3129586366dcb718a474e5900c28bac3effed674ecda7eec16

    • Size

      99KB

    • MD5

      c2f9be4ef7e6aa0992f983ca420bf819

    • SHA1

      f035f6ffd7f22a14ae1c1c237f7a6602649f973f

    • SHA256

      0b4e2819e4aa5a3129586366dcb718a474e5900c28bac3effed674ecda7eec16

    • SHA512

      4424d75dff8293a491a3b5ec6d987e501c1e005d5d4af0561f67b59eedb8a3ee61cbd4a676211ca5bf9830cf20ccd3f235351570b9cc6284073a4a984a7d50e8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks