Overview

overview

10

Static

static

0999af8658...71.exe

windows7_x64

10

0999af8658...71.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0999af8658a0e9e9d615aaef147dbc3ba7fbcfa5bb04b68b7cb7b09324e2a871

  • Size

    58KB

  • Sample

    220212-lj9x2sccel

  • MD5

    cbccf3ae80d0b397ff0c9d0083ccad68

  • SHA1

    528f885ff4dbaebeb0de0ad9763585dce4a5657d

  • SHA256

    0999af8658a0e9e9d615aaef147dbc3ba7fbcfa5bb04b68b7cb7b09324e2a871

  • SHA512

    42d4e5dc4a6f53cabe1800deb470a04f211ee6174a3cf833063acb74b9c58b3f31d4510c4c3c6b0101c2cd78befcd604ded7e9d743d35d43f799bf8e5a89791b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0999af8658a0e9e9d615aaef147dbc3ba7fbcfa5bb04b68b7cb7b09324e2a871

    • Size

      58KB

    • MD5

      cbccf3ae80d0b397ff0c9d0083ccad68

    • SHA1

      528f885ff4dbaebeb0de0ad9763585dce4a5657d

    • SHA256

      0999af8658a0e9e9d615aaef147dbc3ba7fbcfa5bb04b68b7cb7b09324e2a871

    • SHA512

      42d4e5dc4a6f53cabe1800deb470a04f211ee6174a3cf833063acb74b9c58b3f31d4510c4c3c6b0101c2cd78befcd604ded7e9d743d35d43f799bf8e5a89791b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks