Overview

overview

10

Static

static

0a167245bd...30.exe

windows7_x64

10

0a167245bd...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a167245bd777501109d9759379d9e547e5b6d2d8344dac033d98fc58f447a30

  • Size

    58KB

  • Sample

    220212-ld7kqsaeh9

  • MD5

    779e5a9f40abfd611849509d8247c1cc

  • SHA1

    b6b9a159e6321301eecbcd1188dc8919bd389be3

  • SHA256

    0a167245bd777501109d9759379d9e547e5b6d2d8344dac033d98fc58f447a30

  • SHA512

    980340a940003213ab8af49fdbc85771c6ae2ccac08a7e88846c9579db1f44c8db3e01df5f5a9e047e65b2be7e4c619c0277792448f86984546bebee404bb892

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a167245bd777501109d9759379d9e547e5b6d2d8344dac033d98fc58f447a30

    • Size

      58KB

    • MD5

      779e5a9f40abfd611849509d8247c1cc

    • SHA1

      b6b9a159e6321301eecbcd1188dc8919bd389be3

    • SHA256

      0a167245bd777501109d9759379d9e547e5b6d2d8344dac033d98fc58f447a30

    • SHA512

      980340a940003213ab8af49fdbc85771c6ae2ccac08a7e88846c9579db1f44c8db3e01df5f5a9e047e65b2be7e4c619c0277792448f86984546bebee404bb892

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks