Overview

overview

10

Static

static

10

0d63de09cb...37.exe

windows7_x64

10

0d63de09cb...37.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d63de09cb6250b72bb60f66f74061132f5838fb95bffa261d08d1841f9f1b37

  • Size

    216KB

  • Sample

    220212-jb4d7ahef9

  • MD5

    9569bf729d6e2f4ec6bc7a96f0e6e6bb

  • SHA1

    d72555cd81bfd0c4d1751139d07e2e6d50b7904e

  • SHA256

    0d63de09cb6250b72bb60f66f74061132f5838fb95bffa261d08d1841f9f1b37

  • SHA512

    14256f4c7c2500eaf63a70672681e400b24757a1a8c4b8ad766b2873805f8b3df7fe66cdbf9b3034265183aea53ada725b528099f96a40aadd934cbd35a27094

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0d63de09cb6250b72bb60f66f74061132f5838fb95bffa261d08d1841f9f1b37

    • Size

      216KB

    • MD5

      9569bf729d6e2f4ec6bc7a96f0e6e6bb

    • SHA1

      d72555cd81bfd0c4d1751139d07e2e6d50b7904e

    • SHA256

      0d63de09cb6250b72bb60f66f74061132f5838fb95bffa261d08d1841f9f1b37

    • SHA512

      14256f4c7c2500eaf63a70672681e400b24757a1a8c4b8ad766b2873805f8b3df7fe66cdbf9b3034265183aea53ada725b528099f96a40aadd934cbd35a27094

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks