Overview

overview

10

Static

static

10

07d4ddc3b7...a3.exe

windows7_x64

10

07d4ddc3b7...a3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07d4ddc3b740b7537974de4bfd5d1e9308e6cdf0e04ca5038187a2185810fda3

  • Size

    99KB

  • Sample

    220212-l89nksbae4

  • MD5

    1e6e993bb626ee9110d960e6f8139c9c

  • SHA1

    c5a6084bbd28ac5ff817f223961587997ba6067a

  • SHA256

    07d4ddc3b740b7537974de4bfd5d1e9308e6cdf0e04ca5038187a2185810fda3

  • SHA512

    1a23aa860b850068a8e1d9cd6a1a086f8333fef21cb5b7773265b58dfd30d59557e7792d2547ac411de2fb312e1b17d32543ba980ee82e792794a08963c23731

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07d4ddc3b740b7537974de4bfd5d1e9308e6cdf0e04ca5038187a2185810fda3

    • Size

      99KB

    • MD5

      1e6e993bb626ee9110d960e6f8139c9c

    • SHA1

      c5a6084bbd28ac5ff817f223961587997ba6067a

    • SHA256

      07d4ddc3b740b7537974de4bfd5d1e9308e6cdf0e04ca5038187a2185810fda3

    • SHA512

      1a23aa860b850068a8e1d9cd6a1a086f8333fef21cb5b7773265b58dfd30d59557e7792d2547ac411de2fb312e1b17d32543ba980ee82e792794a08963c23731

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks