Overview

overview

10

Static

static

0a8da3f9e1...27.exe

windows7_x64

10

0a8da3f9e1...27.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a8da3f9e1993fd058ed34e498622c16494c4acfca53875a3cc6749e15f48a27

  • Size

    58KB

  • Sample

    220212-k8k5jsaec3

  • MD5

    b0af0dabd848c9e7aa590d7c89ebe4d5

  • SHA1

    1d60be9fd76d708740e233615175182106aa74d4

  • SHA256

    0a8da3f9e1993fd058ed34e498622c16494c4acfca53875a3cc6749e15f48a27

  • SHA512

    9c7cae53d1a2f8622bcf475fc98f5f814d77411d7f6bbcb83ec045a5f028a6cbeb481c27e25b61573b5c3e26427718774afa9a9327243694b79ec27964800d27

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a8da3f9e1993fd058ed34e498622c16494c4acfca53875a3cc6749e15f48a27

    • Size

      58KB

    • MD5

      b0af0dabd848c9e7aa590d7c89ebe4d5

    • SHA1

      1d60be9fd76d708740e233615175182106aa74d4

    • SHA256

      0a8da3f9e1993fd058ed34e498622c16494c4acfca53875a3cc6749e15f48a27

    • SHA512

      9c7cae53d1a2f8622bcf475fc98f5f814d77411d7f6bbcb83ec045a5f028a6cbeb481c27e25b61573b5c3e26427718774afa9a9327243694b79ec27964800d27

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks