Overview

overview

10

Static

static

0c1da19629...de.exe

windows7_x64

10

0c1da19629...de.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c1da19629d44ad5faef78517744e08edbb15c66f480bab66a2a2ed4306dbcde

  • Size

    35KB

  • Sample

    220212-jtk1kabdem

  • MD5

    f329a4ced326ca4047ad553b9a436e74

  • SHA1

    2cba78fdde86aa5fcbc640894dc1d017d7cb04ba

  • SHA256

    0c1da19629d44ad5faef78517744e08edbb15c66f480bab66a2a2ed4306dbcde

  • SHA512

    1eed19bd5b8ba26af07a04e2c56f9ad2fe3402ed764b282665032c5ebdd4b179a12f24b17bb297623a8ec57beb9a0331e80ac50c5d1e7ff3d467e644a19a4fc8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c1da19629d44ad5faef78517744e08edbb15c66f480bab66a2a2ed4306dbcde

    • Size

      35KB

    • MD5

      f329a4ced326ca4047ad553b9a436e74

    • SHA1

      2cba78fdde86aa5fcbc640894dc1d017d7cb04ba

    • SHA256

      0c1da19629d44ad5faef78517744e08edbb15c66f480bab66a2a2ed4306dbcde

    • SHA512

      1eed19bd5b8ba26af07a04e2c56f9ad2fe3402ed764b282665032c5ebdd4b179a12f24b17bb297623a8ec57beb9a0331e80ac50c5d1e7ff3d467e644a19a4fc8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks