Overview

overview

10

Static

static

0c00d2909b...c6.exe

windows7_x64

10

0c00d2909b...c6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c00d2909bccd9598707c32ad7fed43df9604c3ac47fab13738771f4e6016ec6

  • Size

    58KB

  • Sample

    220212-jv3l1ahgh4

  • MD5

    938279db4df8db64a07cda2042dff616

  • SHA1

    dcc0944bef91ee8bfb3871431b7d49708746feff

  • SHA256

    0c00d2909bccd9598707c32ad7fed43df9604c3ac47fab13738771f4e6016ec6

  • SHA512

    46f95c2170ed2253df34d3ba5fa9a0003d4b321fa21e6ec0f7fd06ec664a3155a7d85c4a80955723ff6e93bacc1ca5008bcae6da7f880d4bf5bb413b9711c79d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c00d2909bccd9598707c32ad7fed43df9604c3ac47fab13738771f4e6016ec6

    • Size

      58KB

    • MD5

      938279db4df8db64a07cda2042dff616

    • SHA1

      dcc0944bef91ee8bfb3871431b7d49708746feff

    • SHA256

      0c00d2909bccd9598707c32ad7fed43df9604c3ac47fab13738771f4e6016ec6

    • SHA512

      46f95c2170ed2253df34d3ba5fa9a0003d4b321fa21e6ec0f7fd06ec664a3155a7d85c4a80955723ff6e93bacc1ca5008bcae6da7f880d4bf5bb413b9711c79d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks