Overview

overview

10

Static

static

10

07e393e273...bf.exe

windows7_x64

10

07e393e273...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07e393e2731320804c1467f9eca9458c1ad1a8a2465eb2d240afb3d8e734c7bf

  • Size

    152KB

  • Sample

    220212-l72lksbad3

  • MD5

    19826e60b4b2a2001c0aa89f1d2781c6

  • SHA1

    574ba4713a06f624010f516c441393537446733f

  • SHA256

    07e393e2731320804c1467f9eca9458c1ad1a8a2465eb2d240afb3d8e734c7bf

  • SHA512

    374699bd7f89119ef8709631a85266dd6aa6f1cb67d01a22484522de993ab916d0307d293c08fe3fae957aebdfd13d208b9aa27bfbc2a1ef68eb6a9fcbb6c7ff

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07e393e2731320804c1467f9eca9458c1ad1a8a2465eb2d240afb3d8e734c7bf

    • Size

      152KB

    • MD5

      19826e60b4b2a2001c0aa89f1d2781c6

    • SHA1

      574ba4713a06f624010f516c441393537446733f

    • SHA256

      07e393e2731320804c1467f9eca9458c1ad1a8a2465eb2d240afb3d8e734c7bf

    • SHA512

      374699bd7f89119ef8709631a85266dd6aa6f1cb67d01a22484522de993ab916d0307d293c08fe3fae957aebdfd13d208b9aa27bfbc2a1ef68eb6a9fcbb6c7ff

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks