Overview

overview

10

Static

static

10

0a8e2caf1a...79.exe

windows7_x64

10

0a8e2caf1a...79.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a8e2caf1a201bfc6e18119fa306cc2ff0e109818f221fb448a4563b13c0c579

  • Size

    99KB

  • Sample

    220212-k8bwwaaeb8

  • MD5

    b27c3e1503e804d841ed889027650be1

  • SHA1

    028e7ea1d53a72fec8eea31830a885773533616e

  • SHA256

    0a8e2caf1a201bfc6e18119fa306cc2ff0e109818f221fb448a4563b13c0c579

  • SHA512

    ae4e22ed0dfcc0608019e854602597bdb323d1c24169ecf0208e84036402f124e1725b2a31c4f2e9e2ee89af01c2afb5864dcf5de2cbd3c8059cb55772420121

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a8e2caf1a201bfc6e18119fa306cc2ff0e109818f221fb448a4563b13c0c579

    • Size

      99KB

    • MD5

      b27c3e1503e804d841ed889027650be1

    • SHA1

      028e7ea1d53a72fec8eea31830a885773533616e

    • SHA256

      0a8e2caf1a201bfc6e18119fa306cc2ff0e109818f221fb448a4563b13c0c579

    • SHA512

      ae4e22ed0dfcc0608019e854602597bdb323d1c24169ecf0208e84036402f124e1725b2a31c4f2e9e2ee89af01c2afb5864dcf5de2cbd3c8059cb55772420121

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks