Overview

overview

10

Static

static

10

0c39dc630d...43.exe

windows7_x64

10

0c39dc630d...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c39dc630d8347bb75b0491c5ddbd0c4cd29a36939fd010f607bf28f6ab9b143

  • Size

    104KB

  • Sample

    220212-jslwgahgf3

  • MD5

    dd5dacb591a48b6f79fbf7807bb47b2b

  • SHA1

    186aafc52d9f9beb1caa7214283387cfe5776a09

  • SHA256

    0c39dc630d8347bb75b0491c5ddbd0c4cd29a36939fd010f607bf28f6ab9b143

  • SHA512

    bb912e0c5eddaa871a07f24a2aa55cdf92b0ed3f805fecc8b038296da6c6fa7bc3f7c5c9f44cc91332f7240a20353ebc6af9b8015cfed1ba5344b2e2bc9c0565

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c39dc630d8347bb75b0491c5ddbd0c4cd29a36939fd010f607bf28f6ab9b143

    • Size

      104KB

    • MD5

      dd5dacb591a48b6f79fbf7807bb47b2b

    • SHA1

      186aafc52d9f9beb1caa7214283387cfe5776a09

    • SHA256

      0c39dc630d8347bb75b0491c5ddbd0c4cd29a36939fd010f607bf28f6ab9b143

    • SHA512

      bb912e0c5eddaa871a07f24a2aa55cdf92b0ed3f805fecc8b038296da6c6fa7bc3f7c5c9f44cc91332f7240a20353ebc6af9b8015cfed1ba5344b2e2bc9c0565

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks