Overview

overview

10

Static

static

10

0bb0a15be7...d7.exe

windows7_x64

10

0bb0a15be7...d7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0bb0a15be7628548c77aeeabce8178886f20c8802ea6a37033e1cdab343c7bd7

  • Size

    92KB

  • Sample

    220212-jzka8ahhd6

  • MD5

    be887eceb6346638b3592d13e571288b

  • SHA1

    b62bcdb36f168286c974f4377936a07a7b6bfdd3

  • SHA256

    0bb0a15be7628548c77aeeabce8178886f20c8802ea6a37033e1cdab343c7bd7

  • SHA512

    180374f7279c5e997f98a94d778fa822119ee64286932c58dd96474612a843680e47cc28e017bb8ceff843c922a87e2a3a56d92e7e0c705f99cc75250b384958

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0bb0a15be7628548c77aeeabce8178886f20c8802ea6a37033e1cdab343c7bd7

    • Size

      92KB

    • MD5

      be887eceb6346638b3592d13e571288b

    • SHA1

      b62bcdb36f168286c974f4377936a07a7b6bfdd3

    • SHA256

      0bb0a15be7628548c77aeeabce8178886f20c8802ea6a37033e1cdab343c7bd7

    • SHA512

      180374f7279c5e997f98a94d778fa822119ee64286932c58dd96474612a843680e47cc28e017bb8ceff843c922a87e2a3a56d92e7e0c705f99cc75250b384958

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks