Overview

overview

10

Static

static

10

0c96e00105...47.exe

windows7_x64

10

0c96e00105...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c96e00105b3325b956d7703d645564f42c138aee4f94d54dc61476e2dc04d47

  • Size

    92KB

  • Sample

    220212-jnqc4ahgb6

  • MD5

    06c22464351949026f8810514582efbd

  • SHA1

    37df999fbf90ca016214432c1a2405efb0261823

  • SHA256

    0c96e00105b3325b956d7703d645564f42c138aee4f94d54dc61476e2dc04d47

  • SHA512

    dcf84f9467d656303206bf2698ac83cc1d10b493a58d2cb6e3bab30fbfce5e2c84d8d1814517f5e45dde35e67523b50214ec4053102dae0db13ee85d6df577dd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c96e00105b3325b956d7703d645564f42c138aee4f94d54dc61476e2dc04d47

    • Size

      92KB

    • MD5

      06c22464351949026f8810514582efbd

    • SHA1

      37df999fbf90ca016214432c1a2405efb0261823

    • SHA256

      0c96e00105b3325b956d7703d645564f42c138aee4f94d54dc61476e2dc04d47

    • SHA512

      dcf84f9467d656303206bf2698ac83cc1d10b493a58d2cb6e3bab30fbfce5e2c84d8d1814517f5e45dde35e67523b50214ec4053102dae0db13ee85d6df577dd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks