Overview

overview

10

Static

static

08286e36c8...83.exe

windows7_x64

10

08286e36c8...83.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08286e36c8e385050876530e24e114e674d9816891e201febdbb3f3d83f86d83

  • Size

    58KB

  • Sample

    220212-l4k5escehn

  • MD5

    790f0e00c58bcf37ded5f23272afaf45

  • SHA1

    1caf61c33b16dc25e674936d299b3b3268374e1b

  • SHA256

    08286e36c8e385050876530e24e114e674d9816891e201febdbb3f3d83f86d83

  • SHA512

    632a168f26a3786ea16525129fb195922a0b3ace1b0d5e621cc551b50bb3275e85d5aaf2e90ffd1ad4c1b258041fdba79e8d2914497bc3bd392b2bb9c457c312

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08286e36c8e385050876530e24e114e674d9816891e201febdbb3f3d83f86d83

    • Size

      58KB

    • MD5

      790f0e00c58bcf37ded5f23272afaf45

    • SHA1

      1caf61c33b16dc25e674936d299b3b3268374e1b

    • SHA256

      08286e36c8e385050876530e24e114e674d9816891e201febdbb3f3d83f86d83

    • SHA512

      632a168f26a3786ea16525129fb195922a0b3ace1b0d5e621cc551b50bb3275e85d5aaf2e90ffd1ad4c1b258041fdba79e8d2914497bc3bd392b2bb9c457c312

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks