Overview

overview

10

Static

static

10

0be2c58c1b...94.exe

windows7_x64

10

0be2c58c1b...94.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0be2c58c1bf36fb93ff3dfb601779bac23597373f4a4b18a2a79554b30a88a94

  • Size

    216KB

  • Sample

    220212-jw78wahha9

  • MD5

    a847c1156f93ec2da25b7f7156a67545

  • SHA1

    fca9c992d90f89b4591be8301a9c039fb34c9723

  • SHA256

    0be2c58c1bf36fb93ff3dfb601779bac23597373f4a4b18a2a79554b30a88a94

  • SHA512

    6de3d529577cc8c2f28f38549a8ae0ade0d9a9898a8a1bb783dbed460d942567760f7449ce8fdfb7487d5d2a5d3efe78b1c2a4dbb29f26362b992f9c316941db

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0be2c58c1bf36fb93ff3dfb601779bac23597373f4a4b18a2a79554b30a88a94

    • Size

      216KB

    • MD5

      a847c1156f93ec2da25b7f7156a67545

    • SHA1

      fca9c992d90f89b4591be8301a9c039fb34c9723

    • SHA256

      0be2c58c1bf36fb93ff3dfb601779bac23597373f4a4b18a2a79554b30a88a94

    • SHA512

      6de3d529577cc8c2f28f38549a8ae0ade0d9a9898a8a1bb783dbed460d942567760f7449ce8fdfb7487d5d2a5d3efe78b1c2a4dbb29f26362b992f9c316941db

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks