Overview

overview

10

Static

static

10

09bdcfffdc...4a.exe

windows7_x64

10

09bdcfffdc...4a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09bdcfffdc11b330a3e7fdb084ac4422bdbad951cdc5478d27526b18e5050c4a

  • Size

    80KB

  • Sample

    220212-lhx7vsafd8

  • MD5

    3df6cce53e1c4ac23896209eea50311d

  • SHA1

    d764aaeddaa37c3a08d9added36aaa4874d7697c

  • SHA256

    09bdcfffdc11b330a3e7fdb084ac4422bdbad951cdc5478d27526b18e5050c4a

  • SHA512

    115cc7cd93943595a4f275dcbb63a51ec711520f1290813fa6d4f07ac533702cc38c1f082f3d2376ebcbd1f9d141b97336ee8652a453e0805979a651956750ad

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09bdcfffdc11b330a3e7fdb084ac4422bdbad951cdc5478d27526b18e5050c4a

    • Size

      80KB

    • MD5

      3df6cce53e1c4ac23896209eea50311d

    • SHA1

      d764aaeddaa37c3a08d9added36aaa4874d7697c

    • SHA256

      09bdcfffdc11b330a3e7fdb084ac4422bdbad951cdc5478d27526b18e5050c4a

    • SHA512

      115cc7cd93943595a4f275dcbb63a51ec711520f1290813fa6d4f07ac533702cc38c1f082f3d2376ebcbd1f9d141b97336ee8652a453e0805979a651956750ad

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks