Overview

overview

10

Static

static

0a84f39856...ff.exe

windows7_x64

10

0a84f39856...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a84f398561e6e80eacf16077bbbbd348e6a3c54b60ae6042558c4306e2a37ff

  • Size

    60KB

  • Sample

    220212-k9jywacbcm

  • MD5

    148c0a9b9dad051de6364412b5603c19

  • SHA1

    fcc045ca1faa5d89d52bdfe223baab5461629a7c

  • SHA256

    0a84f398561e6e80eacf16077bbbbd348e6a3c54b60ae6042558c4306e2a37ff

  • SHA512

    33defcec32890e9868bcb3e5aa6abaea8ac8c68bdfa82c1a1c0787e77b55c348b4b87839b3104edb16b571b853458a80bd5f5cbd877d58f989659328e81fa8cd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a84f398561e6e80eacf16077bbbbd348e6a3c54b60ae6042558c4306e2a37ff

    • Size

      60KB

    • MD5

      148c0a9b9dad051de6364412b5603c19

    • SHA1

      fcc045ca1faa5d89d52bdfe223baab5461629a7c

    • SHA256

      0a84f398561e6e80eacf16077bbbbd348e6a3c54b60ae6042558c4306e2a37ff

    • SHA512

      33defcec32890e9868bcb3e5aa6abaea8ac8c68bdfa82c1a1c0787e77b55c348b4b87839b3104edb16b571b853458a80bd5f5cbd877d58f989659328e81fa8cd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks