Overview

overview

10

Static

static

0aecc679bb...0d.exe

windows7_x64

10

0aecc679bb...0d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0aecc679bb0cbe2a6b3c14370b5bb8d41c447aae6aa519ab26d4f38b2a0c1a0d

  • Size

    58KB

  • Sample

    220212-kfc88sabb9

  • MD5

    063f97784a828ae3c7d5fbc0d2e582d2

  • SHA1

    9c4fdb093098412d150787328d9cdac60a053670

  • SHA256

    0aecc679bb0cbe2a6b3c14370b5bb8d41c447aae6aa519ab26d4f38b2a0c1a0d

  • SHA512

    633cbaad0e97228732c2faef96e6ab1a3c32631fb7814360b734db147fa7f72a72acff14c2e01f3f828236f1ef8ae11f08a74c992d570fb217998a9521436b8c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0aecc679bb0cbe2a6b3c14370b5bb8d41c447aae6aa519ab26d4f38b2a0c1a0d

    • Size

      58KB

    • MD5

      063f97784a828ae3c7d5fbc0d2e582d2

    • SHA1

      9c4fdb093098412d150787328d9cdac60a053670

    • SHA256

      0aecc679bb0cbe2a6b3c14370b5bb8d41c447aae6aa519ab26d4f38b2a0c1a0d

    • SHA512

      633cbaad0e97228732c2faef96e6ab1a3c32631fb7814360b734db147fa7f72a72acff14c2e01f3f828236f1ef8ae11f08a74c992d570fb217998a9521436b8c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks