Overview

overview

10

Static

static

09da00477a...55.exe

windows7_x64

10

09da00477a...55.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09da00477a57bf58069957ef688cbcdc9863e3020f49acf957656b05f8c90f55

  • Size

    58KB

  • Sample

    220212-lgqfmaccbr

  • MD5

    40b644eb95059971511e26a082c953c1

  • SHA1

    dc00c3c86453f0450ce9abc0600210e20c78183b

  • SHA256

    09da00477a57bf58069957ef688cbcdc9863e3020f49acf957656b05f8c90f55

  • SHA512

    972372f7380282e2e63feec610cc8e0007856bb4daf52ee342b42d9d3f59f307d015448c3851fea3bdd6227cf8b67ec5def78f0647b3c41d11ba25ab0a6e3bc4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09da00477a57bf58069957ef688cbcdc9863e3020f49acf957656b05f8c90f55

    • Size

      58KB

    • MD5

      40b644eb95059971511e26a082c953c1

    • SHA1

      dc00c3c86453f0450ce9abc0600210e20c78183b

    • SHA256

      09da00477a57bf58069957ef688cbcdc9863e3020f49acf957656b05f8c90f55

    • SHA512

      972372f7380282e2e63feec610cc8e0007856bb4daf52ee342b42d9d3f59f307d015448c3851fea3bdd6227cf8b67ec5def78f0647b3c41d11ba25ab0a6e3bc4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks