Overview

overview

10

Static

static

07c888c27e...fb.exe

windows7_x64

10

07c888c27e...fb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07c888c27edeafc9b3fba98eb30620b81dcb3a904f178e2fcfa1a7881d93f5fb

  • Size

    60KB

  • Sample

    220212-l9ympscfgl

  • MD5

    7c53376faeaa9f2b0e1ff98b5d6867e2

  • SHA1

    dc7749eebbcd5943913436d5cab1d1afffae23ce

  • SHA256

    07c888c27edeafc9b3fba98eb30620b81dcb3a904f178e2fcfa1a7881d93f5fb

  • SHA512

    0a94f36e7a9df284eea67aa897e4944b682ad4e162a85ba36d4e6811f2c610398c6af63f1b4b8a97e24dcba7d1abcb2d867697404d91ee3de0c6bd7a9dc74ff2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07c888c27edeafc9b3fba98eb30620b81dcb3a904f178e2fcfa1a7881d93f5fb

    • Size

      60KB

    • MD5

      7c53376faeaa9f2b0e1ff98b5d6867e2

    • SHA1

      dc7749eebbcd5943913436d5cab1d1afffae23ce

    • SHA256

      07c888c27edeafc9b3fba98eb30620b81dcb3a904f178e2fcfa1a7881d93f5fb

    • SHA512

      0a94f36e7a9df284eea67aa897e4944b682ad4e162a85ba36d4e6811f2c610398c6af63f1b4b8a97e24dcba7d1abcb2d867697404d91ee3de0c6bd7a9dc74ff2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks