Overview

overview

10

Static

static

10

0a6069cf22...87.exe

windows7_x64

10

0a6069cf22...87.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a6069cf22def0c2529a66e0477467f24e083bc990bc3b24225fc957e30f2b87

  • Size

    216KB

  • Sample

    220212-laytesaed5

  • MD5

    7f0eefea9b5a52b33f9ef490f599a1fe

  • SHA1

    4346091f85766bce7167d87312e05f2073a15bff

  • SHA256

    0a6069cf22def0c2529a66e0477467f24e083bc990bc3b24225fc957e30f2b87

  • SHA512

    2258572f2bdcd9cfb5c8e9943f5f1d00a59d43aea39db2f6cb95887dd741f79b0660cf332fec82375bdc28e7d575711ff0cd756228c76adf032fcc5884b6efd7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a6069cf22def0c2529a66e0477467f24e083bc990bc3b24225fc957e30f2b87

    • Size

      216KB

    • MD5

      7f0eefea9b5a52b33f9ef490f599a1fe

    • SHA1

      4346091f85766bce7167d87312e05f2073a15bff

    • SHA256

      0a6069cf22def0c2529a66e0477467f24e083bc990bc3b24225fc957e30f2b87

    • SHA512

      2258572f2bdcd9cfb5c8e9943f5f1d00a59d43aea39db2f6cb95887dd741f79b0660cf332fec82375bdc28e7d575711ff0cd756228c76adf032fcc5884b6efd7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks