Overview

overview

10

Static

static

0cb9373a26...f3.exe

windows7_x64

10

0cb9373a26...f3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cb9373a26583c8b967d768ce81b23ad0c55d17040e44f0b7b827bc9012056f3

  • Size

    60KB

  • Sample

    220212-jk5nlshfh4

  • MD5

    50d670eb0ed9167533a40f94d5857d03

  • SHA1

    eb9ced72502bed0691f7ee7c4cef9cc1c51ae8d0

  • SHA256

    0cb9373a26583c8b967d768ce81b23ad0c55d17040e44f0b7b827bc9012056f3

  • SHA512

    782c70610de82014cd32f193bec343587e3f096caa0876cd3f88285718c9f198a1cdeed9e1dfada00efd63630a88bd96b9979aee2c2285c7bca02e59788236df

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cb9373a26583c8b967d768ce81b23ad0c55d17040e44f0b7b827bc9012056f3

    • Size

      60KB

    • MD5

      50d670eb0ed9167533a40f94d5857d03

    • SHA1

      eb9ced72502bed0691f7ee7c4cef9cc1c51ae8d0

    • SHA256

      0cb9373a26583c8b967d768ce81b23ad0c55d17040e44f0b7b827bc9012056f3

    • SHA512

      782c70610de82014cd32f193bec343587e3f096caa0876cd3f88285718c9f198a1cdeed9e1dfada00efd63630a88bd96b9979aee2c2285c7bca02e59788236df

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks