Overview

overview

10

Static

static

0be33c091a...fe.exe

windows7_x64

10

0be33c091a...fe.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe

  • Size

    35KB

  • Sample

    220212-jw54hshha8

  • MD5

    072f784196a205fd0ec37a122b04f571

  • SHA1

    7e863e15d34747c03b3193d184369b75120ec664

  • SHA256

    0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe

  • SHA512

    874e5ed18e32efa714ad0ff8b47a7b3580c102cdbf304910b4bc41b1f57a93c6bf03f714c810fd2b19a7492cd69200dfb0cd27f1f596444ddb443b9e2d5aadda

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe

    • Size

      35KB

    • MD5

      072f784196a205fd0ec37a122b04f571

    • SHA1

      7e863e15d34747c03b3193d184369b75120ec664

    • SHA256

      0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe

    • SHA512

      874e5ed18e32efa714ad0ff8b47a7b3580c102cdbf304910b4bc41b1f57a93c6bf03f714c810fd2b19a7492cd69200dfb0cd27f1f596444ddb443b9e2d5aadda

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks