Overview

overview

10

Static

static

10

08098d737d...1f.exe

windows7_x64

10

08098d737d...1f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08098d737d8a3c469ba401a69fba1141fa3ded79fea264234a740f7e6d41a91f

  • Size

    150KB

  • Sample

    220212-l52tkabab5

  • MD5

    3adfee89badf85eca3d58731735d15aa

  • SHA1

    f8f58b49e46a1729924c0a5048c23ae431fe6e7c

  • SHA256

    08098d737d8a3c469ba401a69fba1141fa3ded79fea264234a740f7e6d41a91f

  • SHA512

    9af5b25e3d5bd98ee675a692789d4c77e87d5977a17810a0731e46d8bee06a9629cb1a2c6c33100f37646bce95fdb1867a85afb0387b613f570559716c260b52

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08098d737d8a3c469ba401a69fba1141fa3ded79fea264234a740f7e6d41a91f

    • Size

      150KB

    • MD5

      3adfee89badf85eca3d58731735d15aa

    • SHA1

      f8f58b49e46a1729924c0a5048c23ae431fe6e7c

    • SHA256

      08098d737d8a3c469ba401a69fba1141fa3ded79fea264234a740f7e6d41a91f

    • SHA512

      9af5b25e3d5bd98ee675a692789d4c77e87d5977a17810a0731e46d8bee06a9629cb1a2c6c33100f37646bce95fdb1867a85afb0387b613f570559716c260b52

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks