Overview

overview

10

Static

static

07dc9c532f...5f.exe

windows7_x64

10

07dc9c532f...5f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07dc9c532f71af234aba1b6fd603f3575814d480e799a8a1e48bac73ae6c0a5f

  • Size

    35KB

  • Sample

    220212-l8g9bsbad7

  • MD5

    6763b2540316402146274a0c48ed9a7b

  • SHA1

    c4e18b033167afa85bd843521eb106d86f2b2ac2

  • SHA256

    07dc9c532f71af234aba1b6fd603f3575814d480e799a8a1e48bac73ae6c0a5f

  • SHA512

    301b8c069fdb755e724da4ed4e464d90e4b7c899f058162bb039792461df77a156e9404dbfef4c6cbed8a0731af016fde08343b29897c846f1a3802eadc7bc26

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07dc9c532f71af234aba1b6fd603f3575814d480e799a8a1e48bac73ae6c0a5f

    • Size

      35KB

    • MD5

      6763b2540316402146274a0c48ed9a7b

    • SHA1

      c4e18b033167afa85bd843521eb106d86f2b2ac2

    • SHA256

      07dc9c532f71af234aba1b6fd603f3575814d480e799a8a1e48bac73ae6c0a5f

    • SHA512

      301b8c069fdb755e724da4ed4e464d90e4b7c899f058162bb039792461df77a156e9404dbfef4c6cbed8a0731af016fde08343b29897c846f1a3802eadc7bc26

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks