Overview

overview

10

Static

static

09699d08bf...4d.exe

windows7_x64

10

09699d08bf...4d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09699d08bf139db9d09d809c4d94b7198d0f1312b5f36e04ed58b155410ffb4d

  • Size

    36KB

  • Sample

    220212-lms4pscchj

  • MD5

    2e8271383f5a43c42080ffb251ad38e0

  • SHA1

    4340d2f4e65b55729441ca02cb56643e813ca6e3

  • SHA256

    09699d08bf139db9d09d809c4d94b7198d0f1312b5f36e04ed58b155410ffb4d

  • SHA512

    44dc70f0b811c268d0cb2b41b58628d99b92156083d0165bdefde06b7df6c2e58a3fd7c36d110a70916fec7309abb19cd497aefa600c7ca3307949be4fd5b815

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09699d08bf139db9d09d809c4d94b7198d0f1312b5f36e04ed58b155410ffb4d

    • Size

      36KB

    • MD5

      2e8271383f5a43c42080ffb251ad38e0

    • SHA1

      4340d2f4e65b55729441ca02cb56643e813ca6e3

    • SHA256

      09699d08bf139db9d09d809c4d94b7198d0f1312b5f36e04ed58b155410ffb4d

    • SHA512

      44dc70f0b811c268d0cb2b41b58628d99b92156083d0165bdefde06b7df6c2e58a3fd7c36d110a70916fec7309abb19cd497aefa600c7ca3307949be4fd5b815

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks