Overview

overview

10

Static

static

10

0b39c6e011...88.exe

windows7_x64

10

0b39c6e011...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b39c6e011e35256d5376b17a9601c004887c421fb91b1da240e7c71458de788

  • Size

    216KB

  • Sample

    220212-j9s14saaf2

  • MD5

    ecfd1e91db1e8187e1bc2185eb4c9634

  • SHA1

    7c483b8aaec005dca89ea3a3a9192794ea9691c9

  • SHA256

    0b39c6e011e35256d5376b17a9601c004887c421fb91b1da240e7c71458de788

  • SHA512

    1704cab2d68069a34e0f676525863b3fd6d62c57d0afe6d031c699653eef3a1a7b5cfcb387a7095ed940167bd2c22ca9bc221d9d538e25b91237f706177d103c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b39c6e011e35256d5376b17a9601c004887c421fb91b1da240e7c71458de788

    • Size

      216KB

    • MD5

      ecfd1e91db1e8187e1bc2185eb4c9634

    • SHA1

      7c483b8aaec005dca89ea3a3a9192794ea9691c9

    • SHA256

      0b39c6e011e35256d5376b17a9601c004887c421fb91b1da240e7c71458de788

    • SHA512

      1704cab2d68069a34e0f676525863b3fd6d62c57d0afe6d031c699653eef3a1a7b5cfcb387a7095ed940167bd2c22ca9bc221d9d538e25b91237f706177d103c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks