Overview

overview

10

Static

static

10

0cb3676380...ec.exe

windows7_x64

10

0cb3676380...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cb3676380100089abda1e6a1b223dc2ec1c37aeabb80fe487063b2cee5b2eec

  • Size

    216KB

  • Sample

    220212-jlfe4shfh6

  • MD5

    0c0c2cd9eaecd58cb47b98ca9a47d158

  • SHA1

    211a2d6610e0052d39d6a2e3f4ae942bd59ce272

  • SHA256

    0cb3676380100089abda1e6a1b223dc2ec1c37aeabb80fe487063b2cee5b2eec

  • SHA512

    ab809fc3c58e030505204d7e7d11a7e20945a335ac9fac79e232b34dd90490018cbc0d1626574ef454c18f6e4e8d27ead8fb58b9fd928d5d4ecf75af80fa81c0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0cb3676380100089abda1e6a1b223dc2ec1c37aeabb80fe487063b2cee5b2eec

    • Size

      216KB

    • MD5

      0c0c2cd9eaecd58cb47b98ca9a47d158

    • SHA1

      211a2d6610e0052d39d6a2e3f4ae942bd59ce272

    • SHA256

      0cb3676380100089abda1e6a1b223dc2ec1c37aeabb80fe487063b2cee5b2eec

    • SHA512

      ab809fc3c58e030505204d7e7d11a7e20945a335ac9fac79e232b34dd90490018cbc0d1626574ef454c18f6e4e8d27ead8fb58b9fd928d5d4ecf75af80fa81c0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks