Overview

overview

10

Static

static

10

0a41ae6f28...a1.exe

windows7_x64

10

0a41ae6f28...a1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a41ae6f283653d856fc2442d566f55080bf364d1d94dff663ee39fdacaa54a1

  • Size

    216KB

  • Sample

    220212-lcavdaaee9

  • MD5

    b8e207a33688f3b6ae451a0963159277

  • SHA1

    008f5add4f3f0a6010c52e96f3ac268f70c02b4c

  • SHA256

    0a41ae6f283653d856fc2442d566f55080bf364d1d94dff663ee39fdacaa54a1

  • SHA512

    b9c7befd99419ce77fb915cb6b17dcef4d110bd7682c191f6304c0afce5c4a63d0c2fb1a545b59510477e19e0dfc17da818545efa2b005c0e98f9c51e7badf76

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a41ae6f283653d856fc2442d566f55080bf364d1d94dff663ee39fdacaa54a1

    • Size

      216KB

    • MD5

      b8e207a33688f3b6ae451a0963159277

    • SHA1

      008f5add4f3f0a6010c52e96f3ac268f70c02b4c

    • SHA256

      0a41ae6f283653d856fc2442d566f55080bf364d1d94dff663ee39fdacaa54a1

    • SHA512

      b9c7befd99419ce77fb915cb6b17dcef4d110bd7682c191f6304c0afce5c4a63d0c2fb1a545b59510477e19e0dfc17da818545efa2b005c0e98f9c51e7badf76

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks