Overview

overview

10

Static

static

10

081cb68757...18.exe

windows7_x64

10

081cb68757...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    081cb6875737b4d131e4eccbd0f5fb365d013b93fe89e1391311573d8a1ffa18

  • Size

    89KB

  • Sample

    220212-l455labaa5

  • MD5

    4ff5d2301809dbedfcbd1c66d10c0654

  • SHA1

    aaa337f703de67db99976ce3f5d7a7d49c2408b4

  • SHA256

    081cb6875737b4d131e4eccbd0f5fb365d013b93fe89e1391311573d8a1ffa18

  • SHA512

    6a2972160ba7287ca586cdebb721c96c9b353c6e249fd2a4f87a663119f398885ec82a90f9e69658b1efe4b831ddb6b0607896a6d425f55d42fae73a4a75f93b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      081cb6875737b4d131e4eccbd0f5fb365d013b93fe89e1391311573d8a1ffa18

    • Size

      89KB

    • MD5

      4ff5d2301809dbedfcbd1c66d10c0654

    • SHA1

      aaa337f703de67db99976ce3f5d7a7d49c2408b4

    • SHA256

      081cb6875737b4d131e4eccbd0f5fb365d013b93fe89e1391311573d8a1ffa18

    • SHA512

      6a2972160ba7287ca586cdebb721c96c9b353c6e249fd2a4f87a663119f398885ec82a90f9e69658b1efe4b831ddb6b0607896a6d425f55d42fae73a4a75f93b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks