Overview

overview

10

Static

static

09939cbae4...c6.exe

windows7_x64

10

09939cbae4...c6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09939cbae4053fe47c3dc741322c797be1403b8b07b456e2ef768193c7173dc6

  • Size

    58KB

  • Sample

    220212-lkdw1accen

  • MD5

    99b6601fa0cd928585de45afc7b8556c

  • SHA1

    27b783dc1296c9625796a85654e44132d2b661ec

  • SHA256

    09939cbae4053fe47c3dc741322c797be1403b8b07b456e2ef768193c7173dc6

  • SHA512

    7ccaac4c13e0af0864d59de225e062cab768042a82a39a1f3ef40e8498e0ef4ccd67077d7aadf6cc39c2ec5c82dae285dfdc5cbc98cec4530aaeae22f550e9f0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09939cbae4053fe47c3dc741322c797be1403b8b07b456e2ef768193c7173dc6

    • Size

      58KB

    • MD5

      99b6601fa0cd928585de45afc7b8556c

    • SHA1

      27b783dc1296c9625796a85654e44132d2b661ec

    • SHA256

      09939cbae4053fe47c3dc741322c797be1403b8b07b456e2ef768193c7173dc6

    • SHA512

      7ccaac4c13e0af0864d59de225e062cab768042a82a39a1f3ef40e8498e0ef4ccd67077d7aadf6cc39c2ec5c82dae285dfdc5cbc98cec4530aaeae22f550e9f0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks