Overview

overview

10

Static

static

10

0acd3a0828...11.exe

windows7_x64

10

0acd3a0828...11.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0acd3a08281f22a554c51c8edd8260a57ba04899fce01b699b98c406abb33711

  • Size

    216KB

  • Sample

    220212-k43tssadg3

  • MD5

    84543bc25daf1e3590140a2442f94c84

  • SHA1

    441315d646f8a3890f0059b5637159409c13d65f

  • SHA256

    0acd3a08281f22a554c51c8edd8260a57ba04899fce01b699b98c406abb33711

  • SHA512

    9c3fde0999075a3bedac1be9724c52fe58f6f65a09b7d4239aed85650ad904728f738d1ab4f16e85af7c23b6642e1eb29c46788967d5d06a779b1fb265d95bd0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0acd3a08281f22a554c51c8edd8260a57ba04899fce01b699b98c406abb33711

    • Size

      216KB

    • MD5

      84543bc25daf1e3590140a2442f94c84

    • SHA1

      441315d646f8a3890f0059b5637159409c13d65f

    • SHA256

      0acd3a08281f22a554c51c8edd8260a57ba04899fce01b699b98c406abb33711

    • SHA512

      9c3fde0999075a3bedac1be9724c52fe58f6f65a09b7d4239aed85650ad904728f738d1ab4f16e85af7c23b6642e1eb29c46788967d5d06a779b1fb265d95bd0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks