Overview

overview

10

Static

static

10

080b7408ef...c8.exe

windows7_x64

10

080b7408ef...c8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    080b7408efbb979d7456ff7c1adc651222aa7fe4c676d2f3f80e76be20d9b5c8

  • Size

    99KB

  • Sample

    220212-l5zzzacfar

  • MD5

    4705cd7994fe55bf7fccf50da110ac54

  • SHA1

    c66f43d21aa835502203da039d2225fb67819d64

  • SHA256

    080b7408efbb979d7456ff7c1adc651222aa7fe4c676d2f3f80e76be20d9b5c8

  • SHA512

    0d6abaea1d3a9d46f625b6c26030039dd91fc50809bc62da0a7d4f5a893ca461ddcc0527b9fa2fb63fed284a3592f8cf8d6bc5ff8a39275ee1b43731489d07e1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      080b7408efbb979d7456ff7c1adc651222aa7fe4c676d2f3f80e76be20d9b5c8

    • Size

      99KB

    • MD5

      4705cd7994fe55bf7fccf50da110ac54

    • SHA1

      c66f43d21aa835502203da039d2225fb67819d64

    • SHA256

      080b7408efbb979d7456ff7c1adc651222aa7fe4c676d2f3f80e76be20d9b5c8

    • SHA512

      0d6abaea1d3a9d46f625b6c26030039dd91fc50809bc62da0a7d4f5a893ca461ddcc0527b9fa2fb63fed284a3592f8cf8d6bc5ff8a39275ee1b43731489d07e1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks