Overview

overview

10

Static

static

09ad2fd00f...f9.exe

windows7_x64

10

09ad2fd00f...f9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09ad2fd00f014873e9fe0b673604e3ff15c47b89c5c3808bb1a6ed58023921f9

  • Size

    58KB

  • Sample

    220212-ljl6zsaff2

  • MD5

    d0610703cf623d5a13da4f965ebd3cc1

  • SHA1

    204d7fe858f4d14b2c802f1b8277e43e3cad1bcc

  • SHA256

    09ad2fd00f014873e9fe0b673604e3ff15c47b89c5c3808bb1a6ed58023921f9

  • SHA512

    09453f889a2d9d5bc1048fb78efa006cb15ab04fd46c6be951c39b90658ee86aac6cbc0be643e17f0350e953d44d9d9ff3402099ebf4030daf3e30ad0c128057

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09ad2fd00f014873e9fe0b673604e3ff15c47b89c5c3808bb1a6ed58023921f9

    • Size

      58KB

    • MD5

      d0610703cf623d5a13da4f965ebd3cc1

    • SHA1

      204d7fe858f4d14b2c802f1b8277e43e3cad1bcc

    • SHA256

      09ad2fd00f014873e9fe0b673604e3ff15c47b89c5c3808bb1a6ed58023921f9

    • SHA512

      09453f889a2d9d5bc1048fb78efa006cb15ab04fd46c6be951c39b90658ee86aac6cbc0be643e17f0350e953d44d9d9ff3402099ebf4030daf3e30ad0c128057

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks