Overview

overview

10

Static

static

0b3e1ac3f8...2e.exe

windows7_x64

10

0b3e1ac3f8...2e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b3e1ac3f82f1bacdb14074e40837242fb5c5defe8c183aead56e76ae6e1662e

  • Size

    60KB

  • Sample

    220212-j9jgnsaae6

  • MD5

    2ec009ea3e8a54885f6fb878cd46ca3c

  • SHA1

    91c4f5664f71a95ebce4e3df71145bc0e7412079

  • SHA256

    0b3e1ac3f82f1bacdb14074e40837242fb5c5defe8c183aead56e76ae6e1662e

  • SHA512

    6adc699c0f9a9e85b024d5ba01469af593e32114c86960d48f96e7f80135440e3e163c5f61f701a1d4a419b3d2e5e526aaecca75b170b20927236b1da842af5c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b3e1ac3f82f1bacdb14074e40837242fb5c5defe8c183aead56e76ae6e1662e

    • Size

      60KB

    • MD5

      2ec009ea3e8a54885f6fb878cd46ca3c

    • SHA1

      91c4f5664f71a95ebce4e3df71145bc0e7412079

    • SHA256

      0b3e1ac3f82f1bacdb14074e40837242fb5c5defe8c183aead56e76ae6e1662e

    • SHA512

      6adc699c0f9a9e85b024d5ba01469af593e32114c86960d48f96e7f80135440e3e163c5f61f701a1d4a419b3d2e5e526aaecca75b170b20927236b1da842af5c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks