Overview

overview

10

Static

static

10

0a27cd88b2...89.exe

windows7_x64

10

0a27cd88b2...89.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a27cd88b23f97770c19ffe52b3a3340fd46dbdbaef1575b9dd197e63a4dcc89

  • Size

    99KB

  • Sample

    220212-ldmwbscbgj

  • MD5

    7b4f0cbfa0e22b5ee08f1dc624d85007

  • SHA1

    2b2fe5dc192422320adcee65a19a696c2a47f9ba

  • SHA256

    0a27cd88b23f97770c19ffe52b3a3340fd46dbdbaef1575b9dd197e63a4dcc89

  • SHA512

    e9da72f5370e2f4943abd57ef30157522424cf1a095f53550b5d3c33194161f35a6d12312a3c0b364e5d166d476dc63f38d597a869b705a7f57c8075f5a6e64e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a27cd88b23f97770c19ffe52b3a3340fd46dbdbaef1575b9dd197e63a4dcc89

    • Size

      99KB

    • MD5

      7b4f0cbfa0e22b5ee08f1dc624d85007

    • SHA1

      2b2fe5dc192422320adcee65a19a696c2a47f9ba

    • SHA256

      0a27cd88b23f97770c19ffe52b3a3340fd46dbdbaef1575b9dd197e63a4dcc89

    • SHA512

      e9da72f5370e2f4943abd57ef30157522424cf1a095f53550b5d3c33194161f35a6d12312a3c0b364e5d166d476dc63f38d597a869b705a7f57c8075f5a6e64e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks