Overview

overview

10

Static

static

10

0d766510ec...8d.exe

windows7_x64

10

0d766510ec...8d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d766510ecf3c0c605e8121e057f85dbe4280b48ef67a0489569e9b7fbb6478d

  • Size

    100KB

  • Sample

    220212-jbbzyabahr

  • MD5

    7bfba06d804348981a7559484793a8dc

  • SHA1

    078faa0c7a4de6572ae2d4bac80a3892e131f983

  • SHA256

    0d766510ecf3c0c605e8121e057f85dbe4280b48ef67a0489569e9b7fbb6478d

  • SHA512

    7adde601b73ab0418c3a9f0b6b42975677a39440948cc68baeb5f1cdcd7b8a6849baa8f1be77f9d1e9158e05f836b03e961cb7a2e21c090c0d78c640a4bbd634

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0d766510ecf3c0c605e8121e057f85dbe4280b48ef67a0489569e9b7fbb6478d

    • Size

      100KB

    • MD5

      7bfba06d804348981a7559484793a8dc

    • SHA1

      078faa0c7a4de6572ae2d4bac80a3892e131f983

    • SHA256

      0d766510ecf3c0c605e8121e057f85dbe4280b48ef67a0489569e9b7fbb6478d

    • SHA512

      7adde601b73ab0418c3a9f0b6b42975677a39440948cc68baeb5f1cdcd7b8a6849baa8f1be77f9d1e9158e05f836b03e961cb7a2e21c090c0d78c640a4bbd634

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks