Overview

overview

10

Static

static

10

0a8deb296f...7e.exe

windows7_x64

10

0a8deb296f...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a8deb296f8cc33a5ec2a2044370517d3d0871d99c55798e511c43d78426797e

  • Size

    79KB

  • Sample

    220212-k8fvtsaec2

  • MD5

    09ea60372a476449e644695a97539c82

  • SHA1

    9335caf95c9eb5f40ffbcb56dcc2cd90740200d1

  • SHA256

    0a8deb296f8cc33a5ec2a2044370517d3d0871d99c55798e511c43d78426797e

  • SHA512

    c723c5c8c6c1af3f7c2ecae5b644be0920f1925477c3912bb146f65e990aa528a8cae0cd6e45d350d670c03e060696cb06a435ab6791744e789fcd4ae4381377

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a8deb296f8cc33a5ec2a2044370517d3d0871d99c55798e511c43d78426797e

    • Size

      79KB

    • MD5

      09ea60372a476449e644695a97539c82

    • SHA1

      9335caf95c9eb5f40ffbcb56dcc2cd90740200d1

    • SHA256

      0a8deb296f8cc33a5ec2a2044370517d3d0871d99c55798e511c43d78426797e

    • SHA512

      c723c5c8c6c1af3f7c2ecae5b644be0920f1925477c3912bb146f65e990aa528a8cae0cd6e45d350d670c03e060696cb06a435ab6791744e789fcd4ae4381377

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks