Overview

overview

10

Static

static

0c0fda3a53...06.exe

windows7_x64

10

0c0fda3a53...06.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c0fda3a53f4b3bea98f794aecc9039af3e19b78e36a1364bb20b8cfe8e9cc06

  • Size

    60KB

  • Sample

    220212-jvdb4shgg8

  • MD5

    3185e30ac7682e59881d4e5cd113dfd6

  • SHA1

    4d641bf997e88258704caec4293e897ce2edff32

  • SHA256

    0c0fda3a53f4b3bea98f794aecc9039af3e19b78e36a1364bb20b8cfe8e9cc06

  • SHA512

    e31dc247d990cd6332901f1b9f818d6c1dba4bbb67065f4ced4969ce5a7c019ee52f77e148981a09fd26f45d0bda28ca534fc59dd06bb80a26301c7d76f1eef9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c0fda3a53f4b3bea98f794aecc9039af3e19b78e36a1364bb20b8cfe8e9cc06

    • Size

      60KB

    • MD5

      3185e30ac7682e59881d4e5cd113dfd6

    • SHA1

      4d641bf997e88258704caec4293e897ce2edff32

    • SHA256

      0c0fda3a53f4b3bea98f794aecc9039af3e19b78e36a1364bb20b8cfe8e9cc06

    • SHA512

      e31dc247d990cd6332901f1b9f818d6c1dba4bbb67065f4ced4969ce5a7c019ee52f77e148981a09fd26f45d0bda28ca534fc59dd06bb80a26301c7d76f1eef9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks