Overview

overview

10

Static

static

0c2e6ec7d0...34.exe

windows7_x64

10

0c2e6ec7d0...34.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c2e6ec7d04cdf9f847744727953dd80f9640fcda999875ff3a417e71af21134

  • Size

    58KB

  • Sample

    220212-jsz34abddp

  • MD5

    4661d18fd397591b163c12b37d282dd0

  • SHA1

    7f8d51a8d11075704a6e82db37e86da0f2e83606

  • SHA256

    0c2e6ec7d04cdf9f847744727953dd80f9640fcda999875ff3a417e71af21134

  • SHA512

    f5de2009ee0fa99765e9683b083c6fcd14d1f4e9d18d97a231b8487ac36c54848a02acd9c1e24c41eb3b9b72feffaa6a4503c7bf51e02891b5b3f97988a6b10a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c2e6ec7d04cdf9f847744727953dd80f9640fcda999875ff3a417e71af21134

    • Size

      58KB

    • MD5

      4661d18fd397591b163c12b37d282dd0

    • SHA1

      7f8d51a8d11075704a6e82db37e86da0f2e83606

    • SHA256

      0c2e6ec7d04cdf9f847744727953dd80f9640fcda999875ff3a417e71af21134

    • SHA512

      f5de2009ee0fa99765e9683b083c6fcd14d1f4e9d18d97a231b8487ac36c54848a02acd9c1e24c41eb3b9b72feffaa6a4503c7bf51e02891b5b3f97988a6b10a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks