Overview

overview

10

Static

static

0aacb1e36e...e0.exe

windows7_x64

10

0aacb1e36e...e0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0aacb1e36ef11fb6e652c83bee25d0716385a356aa7d4e86a209e818fecac1e0

  • Size

    60KB

  • Sample

    220212-k7f47scbaj

  • MD5

    0c004ece992c29a7cd95813f1b262f86

  • SHA1

    80b47c3167333db588e04900e92d8a677d177fde

  • SHA256

    0aacb1e36ef11fb6e652c83bee25d0716385a356aa7d4e86a209e818fecac1e0

  • SHA512

    4bbdf9614b92f270bf9d27eb4cb6505707aaef7800dec47a92469d6494997f321b82ca9c18c3577a953c537c5bbfecb36c47495870ed01e3b42fc56505467a38

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0aacb1e36ef11fb6e652c83bee25d0716385a356aa7d4e86a209e818fecac1e0

    • Size

      60KB

    • MD5

      0c004ece992c29a7cd95813f1b262f86

    • SHA1

      80b47c3167333db588e04900e92d8a677d177fde

    • SHA256

      0aacb1e36ef11fb6e652c83bee25d0716385a356aa7d4e86a209e818fecac1e0

    • SHA512

      4bbdf9614b92f270bf9d27eb4cb6505707aaef7800dec47a92469d6494997f321b82ca9c18c3577a953c537c5bbfecb36c47495870ed01e3b42fc56505467a38

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks