Overview

overview

10

Static

static

0c441f9fbb...8e.exe

windows7_x64

10

0c441f9fbb...8e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c441f9fbb75828e3c48f86c00e176cea5b7f93a37a74968adca47aa3b97788e

  • Size

    35KB

  • Sample

    220212-jr6jgshge6

  • MD5

    f047bb35f3956ff138a16fec3fff3483

  • SHA1

    6f305d54896f27f9d14376578666c96943756cb7

  • SHA256

    0c441f9fbb75828e3c48f86c00e176cea5b7f93a37a74968adca47aa3b97788e

  • SHA512

    94b9b761e5be32c8effd8aa80654b34d655270ce3834779d09dadaf9d5ae293422242bbcdd119e3c9970817355eb432f3a3b2fc79f99ccd78fb7f63e5675e6a0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c441f9fbb75828e3c48f86c00e176cea5b7f93a37a74968adca47aa3b97788e

    • Size

      35KB

    • MD5

      f047bb35f3956ff138a16fec3fff3483

    • SHA1

      6f305d54896f27f9d14376578666c96943756cb7

    • SHA256

      0c441f9fbb75828e3c48f86c00e176cea5b7f93a37a74968adca47aa3b97788e

    • SHA512

      94b9b761e5be32c8effd8aa80654b34d655270ce3834779d09dadaf9d5ae293422242bbcdd119e3c9970817355eb432f3a3b2fc79f99ccd78fb7f63e5675e6a0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks