Overview

overview

10

Static

static

09738d5bea...88.exe

windows7_x64

10

09738d5bea...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09738d5beace1c5526842d456a3f542baa6933c0e49cd45ddd2ad7717dc98a88

  • Size

    60KB

  • Sample

    220212-lmhb7sccgn

  • MD5

    78fddc5dd46a5b4b4e3f7a129cb00b11

  • SHA1

    f540a2c7d689532991222ddc2018e70853dd8fc1

  • SHA256

    09738d5beace1c5526842d456a3f542baa6933c0e49cd45ddd2ad7717dc98a88

  • SHA512

    0f46d028795b4cb4bdd4e9ed1c38f662af0d860652922a91510ea0ce3db7506f7c77bf8847780037268e2916ec8188532bf80ab8454fb5a04dfc140c338143b6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09738d5beace1c5526842d456a3f542baa6933c0e49cd45ddd2ad7717dc98a88

    • Size

      60KB

    • MD5

      78fddc5dd46a5b4b4e3f7a129cb00b11

    • SHA1

      f540a2c7d689532991222ddc2018e70853dd8fc1

    • SHA256

      09738d5beace1c5526842d456a3f542baa6933c0e49cd45ddd2ad7717dc98a88

    • SHA512

      0f46d028795b4cb4bdd4e9ed1c38f662af0d860652922a91510ea0ce3db7506f7c77bf8847780037268e2916ec8188532bf80ab8454fb5a04dfc140c338143b6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks