Overview

overview

10

Static

static

09da38ee2f...be.exe

windows7_x64

10

09da38ee2f...be.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09da38ee2f2eca8de9a39e86f14077c2dc7729c3bf4e90f2b4279e286f1186be

  • Size

    60KB

  • Sample

    220212-lgna9safc6

  • MD5

    2e77d5a1da7113c5366d3af1b32ef52b

  • SHA1

    fc7b1cf9148e89ffcc47ce98d72e9a0b61f38263

  • SHA256

    09da38ee2f2eca8de9a39e86f14077c2dc7729c3bf4e90f2b4279e286f1186be

  • SHA512

    9144f2561c127d361b1d5689d0910f82e17b8f047f55083ef5c8e9d9053fde04981e4f0a6b49bd72499f202668a7cab224902583f2494afac2a76455eb9b02f6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09da38ee2f2eca8de9a39e86f14077c2dc7729c3bf4e90f2b4279e286f1186be

    • Size

      60KB

    • MD5

      2e77d5a1da7113c5366d3af1b32ef52b

    • SHA1

      fc7b1cf9148e89ffcc47ce98d72e9a0b61f38263

    • SHA256

      09da38ee2f2eca8de9a39e86f14077c2dc7729c3bf4e90f2b4279e286f1186be

    • SHA512

      9144f2561c127d361b1d5689d0910f82e17b8f047f55083ef5c8e9d9053fde04981e4f0a6b49bd72499f202668a7cab224902583f2494afac2a76455eb9b02f6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks