Overview

overview

10

Static

static

10

0cacb6d865...f2.exe

windows7_x64

10

0cacb6d865...f2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cacb6d8652eb809524f40d3409098eeb13299c7e949f00b92ae0948b7b031f2

  • Size

    80KB

  • Sample

    220212-jl1q2sbcdr

  • MD5

    26f144345fcc6bcfbff07e373dade235

  • SHA1

    4ddde141091b8b401a8ddf8805b3022325537f1c

  • SHA256

    0cacb6d8652eb809524f40d3409098eeb13299c7e949f00b92ae0948b7b031f2

  • SHA512

    b69f4e121260f00374353ef15bd0fd08905f714a705361b0449e38a018322243e8b1122e4e8dfb088e3c7c2af035e638dfb8ad42d62e5913c2ea3cbe35d555d7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cacb6d8652eb809524f40d3409098eeb13299c7e949f00b92ae0948b7b031f2

    • Size

      80KB

    • MD5

      26f144345fcc6bcfbff07e373dade235

    • SHA1

      4ddde141091b8b401a8ddf8805b3022325537f1c

    • SHA256

      0cacb6d8652eb809524f40d3409098eeb13299c7e949f00b92ae0948b7b031f2

    • SHA512

      b69f4e121260f00374353ef15bd0fd08905f714a705361b0449e38a018322243e8b1122e4e8dfb088e3c7c2af035e638dfb8ad42d62e5913c2ea3cbe35d555d7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks