Overview

overview

10

Static

static

0ae7c86668...2c.exe

windows7_x64

10

0ae7c86668...2c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ae7c8666817fefaffbce6a6736a26013768203dc62f5e9f8822099344cae12c

  • Size

    36KB

  • Sample

    220212-kfrfvsabc4

  • MD5

    4a415ef4e98180cb45841d14443b920c

  • SHA1

    d3163e39349184470fb431826472fff670796585

  • SHA256

    0ae7c8666817fefaffbce6a6736a26013768203dc62f5e9f8822099344cae12c

  • SHA512

    b68ef8c07be89da19b0c413aaee7c8501b5d663aade99dce109b220c42609f28a72fb219d3044467146151200a9f28e1a581e8ee0f4e3c0cb68fdd3ed2871e0d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ae7c8666817fefaffbce6a6736a26013768203dc62f5e9f8822099344cae12c

    • Size

      36KB

    • MD5

      4a415ef4e98180cb45841d14443b920c

    • SHA1

      d3163e39349184470fb431826472fff670796585

    • SHA256

      0ae7c8666817fefaffbce6a6736a26013768203dc62f5e9f8822099344cae12c

    • SHA512

      b68ef8c07be89da19b0c413aaee7c8501b5d663aade99dce109b220c42609f28a72fb219d3044467146151200a9f28e1a581e8ee0f4e3c0cb68fdd3ed2871e0d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks