Overview

overview

10

Static

static

0cc4d2b45f...98.exe

windows7_x64

10

0cc4d2b45f...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cc4d2b45f3c13bdd0d67073d091c271c75b30eae48f6c0126eaff1969f8fc98

  • Size

    35KB

  • Sample

    220212-jkg8bahfg8

  • MD5

    328460113e0191847980c8aaf058df67

  • SHA1

    33f24c491a523e18d3fb28848b0483e4b19cc17a

  • SHA256

    0cc4d2b45f3c13bdd0d67073d091c271c75b30eae48f6c0126eaff1969f8fc98

  • SHA512

    311680b9fbb2712db0b405253912af9bb431b4eab927aa2bcedfe8098f054a1c2164c1a29463778ee108ea200c4a9f257bbf0833dfe90fe840e49d8a85a72303

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cc4d2b45f3c13bdd0d67073d091c271c75b30eae48f6c0126eaff1969f8fc98

    • Size

      35KB

    • MD5

      328460113e0191847980c8aaf058df67

    • SHA1

      33f24c491a523e18d3fb28848b0483e4b19cc17a

    • SHA256

      0cc4d2b45f3c13bdd0d67073d091c271c75b30eae48f6c0126eaff1969f8fc98

    • SHA512

      311680b9fbb2712db0b405253912af9bb431b4eab927aa2bcedfe8098f054a1c2164c1a29463778ee108ea200c4a9f257bbf0833dfe90fe840e49d8a85a72303

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks