Overview

overview

10

Static

static

0b31028045...0e.exe

windows7_x64

10

0b31028045...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b310280453c700dc3d23ee279ef5e3d05a6499f44b9c6ed36ecbd7da9fc940e

  • Size

    35KB

  • Sample

    220212-j99zmabfcn

  • MD5

    f7a6b9ef500cb16e1787a8bf91be3d9e

  • SHA1

    a192d4cdbb759af1365a018d5f697be8cd3a9fbe

  • SHA256

    0b310280453c700dc3d23ee279ef5e3d05a6499f44b9c6ed36ecbd7da9fc940e

  • SHA512

    8d8fc2fd38417a845fcb242cd36de0cbe261e1f0b967b7d4e4d71ace9bce61a4adf00eaafde7309ead873275fb318d793b6ec3365efb0b3ff0be9461b01156fb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b310280453c700dc3d23ee279ef5e3d05a6499f44b9c6ed36ecbd7da9fc940e

    • Size

      35KB

    • MD5

      f7a6b9ef500cb16e1787a8bf91be3d9e

    • SHA1

      a192d4cdbb759af1365a018d5f697be8cd3a9fbe

    • SHA256

      0b310280453c700dc3d23ee279ef5e3d05a6499f44b9c6ed36ecbd7da9fc940e

    • SHA512

      8d8fc2fd38417a845fcb242cd36de0cbe261e1f0b967b7d4e4d71ace9bce61a4adf00eaafde7309ead873275fb318d793b6ec3365efb0b3ff0be9461b01156fb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks