Overview

overview

10

Static

static

086e6df443...71.exe

windows7_x64

10

086e6df443...71.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    086e6df44323c1f0c4c990d6ae3bad0b9f13e0eee2f644c5a587019e66812471

  • Size

    60KB

  • Sample

    220212-l12b8scefj

  • MD5

    32ba6334e4d25b3810ec84d329b789a4

  • SHA1

    8bda93f43005ac865708175757ab9eb67700937d

  • SHA256

    086e6df44323c1f0c4c990d6ae3bad0b9f13e0eee2f644c5a587019e66812471

  • SHA512

    cfe6da311fbf6306f2798fd61214412bd2d387b387fef4a68c344c93d874bc8479743aa586c16f1c8576f17610224efe7ad66a4c791a87e558aad374187a24df

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      086e6df44323c1f0c4c990d6ae3bad0b9f13e0eee2f644c5a587019e66812471

    • Size

      60KB

    • MD5

      32ba6334e4d25b3810ec84d329b789a4

    • SHA1

      8bda93f43005ac865708175757ab9eb67700937d

    • SHA256

      086e6df44323c1f0c4c990d6ae3bad0b9f13e0eee2f644c5a587019e66812471

    • SHA512

      cfe6da311fbf6306f2798fd61214412bd2d387b387fef4a68c344c93d874bc8479743aa586c16f1c8576f17610224efe7ad66a4c791a87e558aad374187a24df

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks