Overview

overview

10

Static

static

10

0ca011198f...5a.exe

windows7_x64

10

0ca011198f...5a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ca011198f3ff9e5c8e86c7dcb4ce5db02dbb9f66ace627acb2a3c559d315e5a

  • Size

    191KB

  • Sample

    220212-jmyyvahga9

  • MD5

    6552de73ff76e793a82676bff9e7d160

  • SHA1

    c23c789f5bb2ffd150b6327becf4d9663c1f0b08

  • SHA256

    0ca011198f3ff9e5c8e86c7dcb4ce5db02dbb9f66ace627acb2a3c559d315e5a

  • SHA512

    05037a2b8f75dd9038f749c05d3cfff6dbced3a85fa726867f9e7c1e2c44326379b60e327dbc5712eea746aee5641390b8e1bc412d8ee42fcdc9fb8e6088b3ea

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ca011198f3ff9e5c8e86c7dcb4ce5db02dbb9f66ace627acb2a3c559d315e5a

    • Size

      191KB

    • MD5

      6552de73ff76e793a82676bff9e7d160

    • SHA1

      c23c789f5bb2ffd150b6327becf4d9663c1f0b08

    • SHA256

      0ca011198f3ff9e5c8e86c7dcb4ce5db02dbb9f66ace627acb2a3c559d315e5a

    • SHA512

      05037a2b8f75dd9038f749c05d3cfff6dbced3a85fa726867f9e7c1e2c44326379b60e327dbc5712eea746aee5641390b8e1bc412d8ee42fcdc9fb8e6088b3ea

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks