Overview

overview

10

Static

static

10

0cbab8f72b...a6.exe

windows7_x64

10

0cbab8f72b...a6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cbab8f72bec7840e96a23d03f609300847c1b56b3e886ffbbab52a12a49e7a6

  • Size

    192KB

  • Sample

    220212-jk3t1sbccp

  • MD5

    0324802f27369711353a09edb16fafb9

  • SHA1

    2eb4d91b1447ebb5a7d04e56bed3861eb880d5df

  • SHA256

    0cbab8f72bec7840e96a23d03f609300847c1b56b3e886ffbbab52a12a49e7a6

  • SHA512

    97e872e62d7b7fdc40e29af63eb086fa440d89e8dc59eed3afdf45105aa86e43d3e597e99dfa1de5c427a33f2eefcc2741a6164e689c84c601ff386fa9e10871

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cbab8f72bec7840e96a23d03f609300847c1b56b3e886ffbbab52a12a49e7a6

    • Size

      192KB

    • MD5

      0324802f27369711353a09edb16fafb9

    • SHA1

      2eb4d91b1447ebb5a7d04e56bed3861eb880d5df

    • SHA256

      0cbab8f72bec7840e96a23d03f609300847c1b56b3e886ffbbab52a12a49e7a6

    • SHA512

      97e872e62d7b7fdc40e29af63eb086fa440d89e8dc59eed3afdf45105aa86e43d3e597e99dfa1de5c427a33f2eefcc2741a6164e689c84c601ff386fa9e10871

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks