Overview

overview

10

Static

static

10

09ad01fb43...ea.exe

windows7_x64

10

09ad01fb43...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09ad01fb43edd88dbb149be3c207fc8a32d2c97ae7cbaebcbe60e4292a4648ea

  • Size

    92KB

  • Sample

    220212-ljrfpsaff3

  • MD5

    d9f2ecaa0fffd18cc055e3320acd0390

  • SHA1

    fcb867bfcd5d9ab237639696c98af12c4890e7b3

  • SHA256

    09ad01fb43edd88dbb149be3c207fc8a32d2c97ae7cbaebcbe60e4292a4648ea

  • SHA512

    bf2cfa540ff12c580c04ece5ca7062b394c1745b4e897e22e38aa16b65e6a976f26e6be4cc3ab8d912abbee854eec93baca8f872a3b6998854b58aac24867f8c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09ad01fb43edd88dbb149be3c207fc8a32d2c97ae7cbaebcbe60e4292a4648ea

    • Size

      92KB

    • MD5

      d9f2ecaa0fffd18cc055e3320acd0390

    • SHA1

      fcb867bfcd5d9ab237639696c98af12c4890e7b3

    • SHA256

      09ad01fb43edd88dbb149be3c207fc8a32d2c97ae7cbaebcbe60e4292a4648ea

    • SHA512

      bf2cfa540ff12c580c04ece5ca7062b394c1745b4e897e22e38aa16b65e6a976f26e6be4cc3ab8d912abbee854eec93baca8f872a3b6998854b58aac24867f8c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks