Overview

overview

10

Static

static

10

09adc10f86...d3.exe

windows7_x64

10

09adc10f86...d3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09adc10f86805d09ea113f969fad1715622a166fcaf690933acaf9b3dcfcdfd3

  • Size

    89KB

  • Sample

    220212-ljkcdsafe9

  • MD5

    ad2ba37d4a2bfd4d1dd02d0ebb74aa19

  • SHA1

    5e96b3093f2c75ca95296a225a1f124458125edc

  • SHA256

    09adc10f86805d09ea113f969fad1715622a166fcaf690933acaf9b3dcfcdfd3

  • SHA512

    52090137c162664f03b7239867afcc44b17e3e6bdabb34cde9d22cf90d310e4e1bb35ccff5998e532ac3a04a1d57640da4dc5e15787f50e41c8f98ee537ecdb0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09adc10f86805d09ea113f969fad1715622a166fcaf690933acaf9b3dcfcdfd3

    • Size

      89KB

    • MD5

      ad2ba37d4a2bfd4d1dd02d0ebb74aa19

    • SHA1

      5e96b3093f2c75ca95296a225a1f124458125edc

    • SHA256

      09adc10f86805d09ea113f969fad1715622a166fcaf690933acaf9b3dcfcdfd3

    • SHA512

      52090137c162664f03b7239867afcc44b17e3e6bdabb34cde9d22cf90d310e4e1bb35ccff5998e532ac3a04a1d57640da4dc5e15787f50e41c8f98ee537ecdb0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks