Overview

overview

10

Static

static

084627b811...00.exe

windows7_x64

10

084627b811...00.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    084627b8112e39f4921ca750b944b96450389d42a166710343825b7ec9407800

  • Size

    35KB

  • Sample

    220212-l3hmxacegr

  • MD5

    bccda6a8cba7cca90183dec509a53b72

  • SHA1

    5ac5cbe5b68ee3f272cd39671d88b7e156a6e142

  • SHA256

    084627b8112e39f4921ca750b944b96450389d42a166710343825b7ec9407800

  • SHA512

    402296a35d4ff40b2fdbdf51ad669e7530bb9a98b0ac8a757be907ccf6f9193aa3eef08f12791b64e8f3c84d247cea54c85a83ca393a9479b6a959194783b9a0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      084627b8112e39f4921ca750b944b96450389d42a166710343825b7ec9407800

    • Size

      35KB

    • MD5

      bccda6a8cba7cca90183dec509a53b72

    • SHA1

      5ac5cbe5b68ee3f272cd39671d88b7e156a6e142

    • SHA256

      084627b8112e39f4921ca750b944b96450389d42a166710343825b7ec9407800

    • SHA512

      402296a35d4ff40b2fdbdf51ad669e7530bb9a98b0ac8a757be907ccf6f9193aa3eef08f12791b64e8f3c84d247cea54c85a83ca393a9479b6a959194783b9a0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks