Overview

overview

10

Static

static

10

07fede068d...0e.exe

windows7_x64

10

07fede068d...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07fede068d4156cec78d4f87b8b76f9ccb150c71e1317a4fac8cf50f8c2e8f0e

  • Size

    101KB

  • Sample

    220212-l6n9vsbac3

  • MD5

    fed60769e417cb6919d0d1577280aea8

  • SHA1

    b019a8555532e5b67df62c8ff5b1d47121959115

  • SHA256

    07fede068d4156cec78d4f87b8b76f9ccb150c71e1317a4fac8cf50f8c2e8f0e

  • SHA512

    7bd7193ff146400238e9222d32c64ac0ce1a6d841659ffb780f6d11effde2eb990a931ef4e6f00907a20ec75610b858a12a2465b7a8a9d36e0ff7b4c4775afc9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07fede068d4156cec78d4f87b8b76f9ccb150c71e1317a4fac8cf50f8c2e8f0e

    • Size

      101KB

    • MD5

      fed60769e417cb6919d0d1577280aea8

    • SHA1

      b019a8555532e5b67df62c8ff5b1d47121959115

    • SHA256

      07fede068d4156cec78d4f87b8b76f9ccb150c71e1317a4fac8cf50f8c2e8f0e

    • SHA512

      7bd7193ff146400238e9222d32c64ac0ce1a6d841659ffb780f6d11effde2eb990a931ef4e6f00907a20ec75610b858a12a2465b7a8a9d36e0ff7b4c4775afc9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks