Overview

overview

10

Static

static

0a8cbd0f1e...9d.exe

windows7_x64

10

0a8cbd0f1e...9d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a8cbd0f1ea43fce67c368c5a7b5553b0df349af14ac859e249116d57d5f3c9d

  • Size

    58KB

  • Sample

    220212-k8qd9scbbk

  • MD5

    d9530c2cb7834456efde6bb8b67a7fb6

  • SHA1

    c162f37633ba06bedf2925eb584fa5f35b8cb905

  • SHA256

    0a8cbd0f1ea43fce67c368c5a7b5553b0df349af14ac859e249116d57d5f3c9d

  • SHA512

    424532ee1b662d6b84c0666cb7b280981b006041e3526065d2605716cce982be2644d0b4b2510971f387419198680aff1e069a07c6a1b8cef2ca51dfecc78dac

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a8cbd0f1ea43fce67c368c5a7b5553b0df349af14ac859e249116d57d5f3c9d

    • Size

      58KB

    • MD5

      d9530c2cb7834456efde6bb8b67a7fb6

    • SHA1

      c162f37633ba06bedf2925eb584fa5f35b8cb905

    • SHA256

      0a8cbd0f1ea43fce67c368c5a7b5553b0df349af14ac859e249116d57d5f3c9d

    • SHA512

      424532ee1b662d6b84c0666cb7b280981b006041e3526065d2605716cce982be2644d0b4b2510971f387419198680aff1e069a07c6a1b8cef2ca51dfecc78dac

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks