Overview

overview

10

Static

static

0c82e6dce4...23.exe

windows7_x64

10

0c82e6dce4...23.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c82e6dce43b2b1b938c1ea9e6c8a033a19112f89d4e9ddf47c6240036938223

  • Size

    60KB

  • Sample

    220212-jqaqeshgc8

  • MD5

    75dfca14f72d431f6bd4faf37c049737

  • SHA1

    3ba0d8e99d2a2d1496672b2d3c633fedad00d372

  • SHA256

    0c82e6dce43b2b1b938c1ea9e6c8a033a19112f89d4e9ddf47c6240036938223

  • SHA512

    ca6baf655bbeee764a0da00fdb8cd3523425560d5acddaacaacddc9e7726414d1e862f326dc2885fcc80c306e6fb9d12f081cae6ffe7ea68f9306bc4413639e1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c82e6dce43b2b1b938c1ea9e6c8a033a19112f89d4e9ddf47c6240036938223

    • Size

      60KB

    • MD5

      75dfca14f72d431f6bd4faf37c049737

    • SHA1

      3ba0d8e99d2a2d1496672b2d3c633fedad00d372

    • SHA256

      0c82e6dce43b2b1b938c1ea9e6c8a033a19112f89d4e9ddf47c6240036938223

    • SHA512

      ca6baf655bbeee764a0da00fdb8cd3523425560d5acddaacaacddc9e7726414d1e862f326dc2885fcc80c306e6fb9d12f081cae6ffe7ea68f9306bc4413639e1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks