Overview

overview

10

Static

static

0d3e6e1e4e...0c.exe

windows7_x64

10

0d3e6e1e4e...0c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d3e6e1e4e10c7e366a65a5d7829053b0ddc43b9f70e9965bc411c3efe386f0c

  • Size

    58KB

  • Sample

    220212-jdpzksbbdj

  • MD5

    eabef2d4612cfd3a6e1863da5e183b56

  • SHA1

    0b9a0caa06e1c086b9395de9971a1129c597b50e

  • SHA256

    0d3e6e1e4e10c7e366a65a5d7829053b0ddc43b9f70e9965bc411c3efe386f0c

  • SHA512

    1250a1dda828041694c562098132380abaaa38a34b89cfead8af4691fd166249b9b69ad74e34403a3ec13f0517d6af87282c64d1227ece97c80024ed068074bf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0d3e6e1e4e10c7e366a65a5d7829053b0ddc43b9f70e9965bc411c3efe386f0c

    • Size

      58KB

    • MD5

      eabef2d4612cfd3a6e1863da5e183b56

    • SHA1

      0b9a0caa06e1c086b9395de9971a1129c597b50e

    • SHA256

      0d3e6e1e4e10c7e366a65a5d7829053b0ddc43b9f70e9965bc411c3efe386f0c

    • SHA512

      1250a1dda828041694c562098132380abaaa38a34b89cfead8af4691fd166249b9b69ad74e34403a3ec13f0517d6af87282c64d1227ece97c80024ed068074bf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks