Overview

overview

10

Static

static

0a11268124...f9.exe

windows7_x64

10

0a11268124...f9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a11268124b6e7274a63c64b8c520558b9bbdbb97672e02db0796b106888a2f9

  • Size

    36KB

  • Sample

    220212-lehyrscbgp

  • MD5

    ae145095105c0bc4baf02402dc7af1db

  • SHA1

    698afddeb06b1de6d52649f9bee6b0a5a9b23974

  • SHA256

    0a11268124b6e7274a63c64b8c520558b9bbdbb97672e02db0796b106888a2f9

  • SHA512

    abc42a251cd0985f25e64dce74436527d009aae7a99eae8c689d77de8a63b6d79aba728a9efe70c65c7c576d02aeb810ab1969d2bf6b2f4c34ec19d31a33d7d8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0a11268124b6e7274a63c64b8c520558b9bbdbb97672e02db0796b106888a2f9

    • Size

      36KB

    • MD5

      ae145095105c0bc4baf02402dc7af1db

    • SHA1

      698afddeb06b1de6d52649f9bee6b0a5a9b23974

    • SHA256

      0a11268124b6e7274a63c64b8c520558b9bbdbb97672e02db0796b106888a2f9

    • SHA512

      abc42a251cd0985f25e64dce74436527d009aae7a99eae8c689d77de8a63b6d79aba728a9efe70c65c7c576d02aeb810ab1969d2bf6b2f4c34ec19d31a33d7d8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks