Overview

overview

10

Static

static

085d58f44d...24.exe

windows7_x64

10

085d58f44d...24.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    085d58f44d27afce67fba4ec989585bbd95fd42963937490d60e3232f68bb024

  • Size

    58KB

  • Sample

    220212-l2ql5acegj

  • MD5

    ed582374f649c873b1eb033953bbec0a

  • SHA1

    6340f9219ba8ad1c5ae1e3a0167fa54d44446023

  • SHA256

    085d58f44d27afce67fba4ec989585bbd95fd42963937490d60e3232f68bb024

  • SHA512

    c7dc7282bdcada18a19aec5cd7a126ec24c43e3704751ae60bee72e867e644a19054e9dc69e5845ea8e534caee986e012ca0c843f646cd75adf7146c562737e9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      085d58f44d27afce67fba4ec989585bbd95fd42963937490d60e3232f68bb024

    • Size

      58KB

    • MD5

      ed582374f649c873b1eb033953bbec0a

    • SHA1

      6340f9219ba8ad1c5ae1e3a0167fa54d44446023

    • SHA256

      085d58f44d27afce67fba4ec989585bbd95fd42963937490d60e3232f68bb024

    • SHA512

      c7dc7282bdcada18a19aec5cd7a126ec24c43e3704751ae60bee72e867e644a19054e9dc69e5845ea8e534caee986e012ca0c843f646cd75adf7146c562737e9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks