Overview

overview

10

Static

static

0a4e5b1b20...c4.exe

windows7_x64

10

0a4e5b1b20...c4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a4e5b1b206bb3e5810a393dd50570155f030e831c5ea6a60577c8f236d5cdc4

  • Size

    35KB

  • Sample

    220212-lbqjfaaee3

  • MD5

    9e6d0b0c221a12229d6b591fa5db14cc

  • SHA1

    6bf032df9f420191db765723117df57f9125c6ca

  • SHA256

    0a4e5b1b206bb3e5810a393dd50570155f030e831c5ea6a60577c8f236d5cdc4

  • SHA512

    32a22e9648476dbfd0e77836a874d2d4a1261c26b6032b89d723119419236fb9381cc54a4d7924e6af337149a66ea382f4985a4824b74cc69d494df3672b3e76

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a4e5b1b206bb3e5810a393dd50570155f030e831c5ea6a60577c8f236d5cdc4

    • Size

      35KB

    • MD5

      9e6d0b0c221a12229d6b591fa5db14cc

    • SHA1

      6bf032df9f420191db765723117df57f9125c6ca

    • SHA256

      0a4e5b1b206bb3e5810a393dd50570155f030e831c5ea6a60577c8f236d5cdc4

    • SHA512

      32a22e9648476dbfd0e77836a874d2d4a1261c26b6032b89d723119419236fb9381cc54a4d7924e6af337149a66ea382f4985a4824b74cc69d494df3672b3e76

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks