Overview

overview

10

Static

static

0ae44733ec...82.exe

windows7_x64

10

0ae44733ec...82.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ae44733ec0f07d2e3854f2dab2703c8c0b79c301824133dc010b25d92f54782

  • Size

    58KB

  • Sample

    220212-kfwetaabc6

  • MD5

    6d6285b95ad316b2d06d5c16b1b04cb7

  • SHA1

    77b5ce6f402d40a8837a182b9d60ac376c156449

  • SHA256

    0ae44733ec0f07d2e3854f2dab2703c8c0b79c301824133dc010b25d92f54782

  • SHA512

    74b6e03b983f438aa10c7e0915e1a3439a835531ac3827a8d4ba4441db9d32bab2d595daf8b94086b86bfc8e5b40b90d6c37a11378d95aa0c43f606453910a2e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0ae44733ec0f07d2e3854f2dab2703c8c0b79c301824133dc010b25d92f54782

    • Size

      58KB

    • MD5

      6d6285b95ad316b2d06d5c16b1b04cb7

    • SHA1

      77b5ce6f402d40a8837a182b9d60ac376c156449

    • SHA256

      0ae44733ec0f07d2e3854f2dab2703c8c0b79c301824133dc010b25d92f54782

    • SHA512

      74b6e03b983f438aa10c7e0915e1a3439a835531ac3827a8d4ba4441db9d32bab2d595daf8b94086b86bfc8e5b40b90d6c37a11378d95aa0c43f606453910a2e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks