Overview

overview

10

Static

static

10

09fe6361c4...39.exe

windows7_x64

10

09fe6361c4...39.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09fe6361c45b001aa3032b82ae1c6287b8d687615a502f8e78fb52f11f9b8239

  • Size

    79KB

  • Sample

    220212-lfe89sccaj

  • MD5

    cc32889924dd325f3d699b7d8ff23a7c

  • SHA1

    924b1ded093d4854f23b58b9cf64651f03d31046

  • SHA256

    09fe6361c45b001aa3032b82ae1c6287b8d687615a502f8e78fb52f11f9b8239

  • SHA512

    8e582d2309910ddd7be3ff592fde534a822d43fd19b3c74a79031777f14d0d0c467a60c7e97cde008c9e42a34c152e1a42f1a07437a20a0cce2efbf53b1a3637

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09fe6361c45b001aa3032b82ae1c6287b8d687615a502f8e78fb52f11f9b8239

    • Size

      79KB

    • MD5

      cc32889924dd325f3d699b7d8ff23a7c

    • SHA1

      924b1ded093d4854f23b58b9cf64651f03d31046

    • SHA256

      09fe6361c45b001aa3032b82ae1c6287b8d687615a502f8e78fb52f11f9b8239

    • SHA512

      8e582d2309910ddd7be3ff592fde534a822d43fd19b3c74a79031777f14d0d0c467a60c7e97cde008c9e42a34c152e1a42f1a07437a20a0cce2efbf53b1a3637

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks