Overview

overview

10

Static

static

10

0a2791ece9...29.exe

windows7_x64

10

0a2791ece9...29.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a2791ece9a850dfa8af624d3f9b59f16e4ecca3c7a461a2635031ad3b8a6a29

  • Size

    92KB

  • Sample

    220212-ldppxsaeh4

  • MD5

    74217d8efee39f07b98658b66ce30bd1

  • SHA1

    07dcbba190d1aeddcd8a7ca8e551b4fdc3dc99f1

  • SHA256

    0a2791ece9a850dfa8af624d3f9b59f16e4ecca3c7a461a2635031ad3b8a6a29

  • SHA512

    9209c7fa8484f0cba6a22afef6f18044a6df356823c6a94e4b37e25f847d2d37a3fc1f21d5923f341879e15e57b09ba20274659e187b8317b97bf3b2a62135e3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a2791ece9a850dfa8af624d3f9b59f16e4ecca3c7a461a2635031ad3b8a6a29

    • Size

      92KB

    • MD5

      74217d8efee39f07b98658b66ce30bd1

    • SHA1

      07dcbba190d1aeddcd8a7ca8e551b4fdc3dc99f1

    • SHA256

      0a2791ece9a850dfa8af624d3f9b59f16e4ecca3c7a461a2635031ad3b8a6a29

    • SHA512

      9209c7fa8484f0cba6a22afef6f18044a6df356823c6a94e4b37e25f847d2d37a3fc1f21d5923f341879e15e57b09ba20274659e187b8317b97bf3b2a62135e3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks