Overview

overview

10

Static

static

10

0a2cd7cd9e...93.exe

windows7_x64

10

0a2cd7cd9e...93.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a2cd7cd9edaea74f7161b5fba0ca1cb2ba7526d41817c81d2756ca26c9ce793

  • Size

    176KB

  • Sample

    220212-lc7jcaaeg5

  • MD5

    51b74929990ae144d4e4c0d602f67718

  • SHA1

    7929ac41daac25953645fb82dbb8cc185bff643c

  • SHA256

    0a2cd7cd9edaea74f7161b5fba0ca1cb2ba7526d41817c81d2756ca26c9ce793

  • SHA512

    e53f57e70d157d560f16839075fb6c9574bf89803b38370a02e473d9c7bab936b30b7aeae7467e7e00629351ebdc305fd764ab0d9ff6a891f5f49abe6eb5083e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a2cd7cd9edaea74f7161b5fba0ca1cb2ba7526d41817c81d2756ca26c9ce793

    • Size

      176KB

    • MD5

      51b74929990ae144d4e4c0d602f67718

    • SHA1

      7929ac41daac25953645fb82dbb8cc185bff643c

    • SHA256

      0a2cd7cd9edaea74f7161b5fba0ca1cb2ba7526d41817c81d2756ca26c9ce793

    • SHA512

      e53f57e70d157d560f16839075fb6c9574bf89803b38370a02e473d9c7bab936b30b7aeae7467e7e00629351ebdc305fd764ab0d9ff6a891f5f49abe6eb5083e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks