Overview

overview

10

Static

static

10

097dd955ef...e8.exe

windows7_x64

10

097dd955ef...e8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    097dd955ef1018729c352b0afc909acc12c362c28d4e69b2b6c1956e795093e8

  • Size

    92KB

  • Sample

    220212-lk75vaafg8

  • MD5

    6d0e1397ec6ca97e5f278c6e468d9ffa

  • SHA1

    df2760fc4fa338b23e469912efaeeedb6ca5deee

  • SHA256

    097dd955ef1018729c352b0afc909acc12c362c28d4e69b2b6c1956e795093e8

  • SHA512

    127df817f3f93618e782dbfdef36c2903c1f1a3d22a733b433556ea047d1a2ae4e08b94896627f49b92b81695d43e78438f43643159ed6f00b53852fae259fea

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      097dd955ef1018729c352b0afc909acc12c362c28d4e69b2b6c1956e795093e8

    • Size

      92KB

    • MD5

      6d0e1397ec6ca97e5f278c6e468d9ffa

    • SHA1

      df2760fc4fa338b23e469912efaeeedb6ca5deee

    • SHA256

      097dd955ef1018729c352b0afc909acc12c362c28d4e69b2b6c1956e795093e8

    • SHA512

      127df817f3f93618e782dbfdef36c2903c1f1a3d22a733b433556ea047d1a2ae4e08b94896627f49b92b81695d43e78438f43643159ed6f00b53852fae259fea

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks