Overview

overview

10

Static

static

10

0c64605d53...09.exe

windows7_x64

10

0c64605d53...09.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c64605d53803e68cdbf70a48dbff51a1eae747f17a4649b04ceb42ce07f2909

  • Size

    99KB

  • Sample

    220212-jrfytshgd8

  • MD5

    ae2392879d46cc22f6a4597b52fdf62d

  • SHA1

    356b18e1972f8509702b453267d915b4b30f0049

  • SHA256

    0c64605d53803e68cdbf70a48dbff51a1eae747f17a4649b04ceb42ce07f2909

  • SHA512

    0b4fabf5265985813efd5e022dc24e97d1f2dd96bc5e5c27cb350ad0d226dd99a6bcf3874f760441d646e9c573e337140487cc801bcaefbdcd5d05a086411360

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c64605d53803e68cdbf70a48dbff51a1eae747f17a4649b04ceb42ce07f2909

    • Size

      99KB

    • MD5

      ae2392879d46cc22f6a4597b52fdf62d

    • SHA1

      356b18e1972f8509702b453267d915b4b30f0049

    • SHA256

      0c64605d53803e68cdbf70a48dbff51a1eae747f17a4649b04ceb42ce07f2909

    • SHA512

      0b4fabf5265985813efd5e022dc24e97d1f2dd96bc5e5c27cb350ad0d226dd99a6bcf3874f760441d646e9c573e337140487cc801bcaefbdcd5d05a086411360

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks