Overview

overview

10

Static

static

10

09e0e801e8...1d.exe

windows7_x64

10

09e0e801e8...1d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09e0e801e8ddfeeeab7908c8859aba2552e78413aad0661c84c3e966d9269f1d

  • Size

    89KB

  • Sample

    220212-lgedcsafc4

  • MD5

    d50589fe7e6df9885f779926d424899c

  • SHA1

    9ea398b6bb9b3a61a29e886f20fab8184311779c

  • SHA256

    09e0e801e8ddfeeeab7908c8859aba2552e78413aad0661c84c3e966d9269f1d

  • SHA512

    a4c0a8efb74ee17ed144bf6989ef7e0467befb319daaa976414462d03d6a3b6710855749bffbab915ddd1d4e2b3952b9a391feefdf76a8f273df64e57c9f60b3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09e0e801e8ddfeeeab7908c8859aba2552e78413aad0661c84c3e966d9269f1d

    • Size

      89KB

    • MD5

      d50589fe7e6df9885f779926d424899c

    • SHA1

      9ea398b6bb9b3a61a29e886f20fab8184311779c

    • SHA256

      09e0e801e8ddfeeeab7908c8859aba2552e78413aad0661c84c3e966d9269f1d

    • SHA512

      a4c0a8efb74ee17ed144bf6989ef7e0467befb319daaa976414462d03d6a3b6710855749bffbab915ddd1d4e2b3952b9a391feefdf76a8f273df64e57c9f60b3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks