Overview

overview

10

Static

static

0a62b4e274...ff.exe

windows7_x64

10

0a62b4e274...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a62b4e274ab5884420ecf18f00dded66c413babf7f54a9e7ca48b2a60c040ff

  • Size

    60KB

  • Sample

    220212-latvgacbek

  • MD5

    376f215db229e91d41a408144b121eda

  • SHA1

    baefb50c6e290adfafe64dcdc727dd3b2c0d4873

  • SHA256

    0a62b4e274ab5884420ecf18f00dded66c413babf7f54a9e7ca48b2a60c040ff

  • SHA512

    6fb61f584d23d603018255230785faed45569ce7f3b889b18b27ec55d346f7b5471334e4002df946187bdd39b9b37626086974fdbd00b2e817fea521cb0ba035

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a62b4e274ab5884420ecf18f00dded66c413babf7f54a9e7ca48b2a60c040ff

    • Size

      60KB

    • MD5

      376f215db229e91d41a408144b121eda

    • SHA1

      baefb50c6e290adfafe64dcdc727dd3b2c0d4873

    • SHA256

      0a62b4e274ab5884420ecf18f00dded66c413babf7f54a9e7ca48b2a60c040ff

    • SHA512

      6fb61f584d23d603018255230785faed45569ce7f3b889b18b27ec55d346f7b5471334e4002df946187bdd39b9b37626086974fdbd00b2e817fea521cb0ba035

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks