Overview

overview

10

Static

static

10

0ac5421c70...45.exe

windows7_x64

10

0ac5421c70...45.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ac5421c704269518f7099aa9ba3d46e43f03059111b9cef88a8193a1e5c7245

  • Size

    100KB

  • Sample

    220212-k5w3mscagn

  • MD5

    fcd3a9a8f7a230886288a72e838938dc

  • SHA1

    718a4c37e84c03ba7b96f1def6b90c1cc3bce4f7

  • SHA256

    0ac5421c704269518f7099aa9ba3d46e43f03059111b9cef88a8193a1e5c7245

  • SHA512

    731dd3ad25b215915ddeb7450f23ab8411fa08a97b7c4ca41321e9b040fa7e71aec72b27a1bc341fb75640e4341d62871a6397ed7ef378bb88959cc8e045a371

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ac5421c704269518f7099aa9ba3d46e43f03059111b9cef88a8193a1e5c7245

    • Size

      100KB

    • MD5

      fcd3a9a8f7a230886288a72e838938dc

    • SHA1

      718a4c37e84c03ba7b96f1def6b90c1cc3bce4f7

    • SHA256

      0ac5421c704269518f7099aa9ba3d46e43f03059111b9cef88a8193a1e5c7245

    • SHA512

      731dd3ad25b215915ddeb7450f23ab8411fa08a97b7c4ca41321e9b040fa7e71aec72b27a1bc341fb75640e4341d62871a6397ed7ef378bb88959cc8e045a371

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks