Overview

overview

10

Static

static

0c514f1163...bc.exe

windows7_x64

10

0c514f1163...bc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c514f1163f6ca86a9877080c8e9b0ef9b659cbc4b68e6107d38a8ce0a8f41bc

  • Size

    58KB

  • Sample

    220212-jrvf8abdcm

  • MD5

    cb2c799c76926321fa3d515572d6805a

  • SHA1

    5598c558e1d080d25e665e9ac8ebcb5d46c6100f

  • SHA256

    0c514f1163f6ca86a9877080c8e9b0ef9b659cbc4b68e6107d38a8ce0a8f41bc

  • SHA512

    999259353943e1f7f2cf138589a62360bccb755a3c97aa4eb1f571ffc97ec14792bf3a881d517c50af322eedb904aaec3b83f47fdd4a5e1c36d860d9f444c6a0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c514f1163f6ca86a9877080c8e9b0ef9b659cbc4b68e6107d38a8ce0a8f41bc

    • Size

      58KB

    • MD5

      cb2c799c76926321fa3d515572d6805a

    • SHA1

      5598c558e1d080d25e665e9ac8ebcb5d46c6100f

    • SHA256

      0c514f1163f6ca86a9877080c8e9b0ef9b659cbc4b68e6107d38a8ce0a8f41bc

    • SHA512

      999259353943e1f7f2cf138589a62360bccb755a3c97aa4eb1f571ffc97ec14792bf3a881d517c50af322eedb904aaec3b83f47fdd4a5e1c36d860d9f444c6a0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks