Overview

overview

10

Static

static

10

0940c0762d...af.exe

windows7_x64

10

0940c0762d...af.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0940c0762d0cabc2ff674d835de0497708cb56c31d4a42c03255bfd8a038dbaf

  • Size

    99KB

  • Sample

    220212-ln9svacdap

  • MD5

    1902b56184c4fb50e458005bad24e69b

  • SHA1

    96a11846d8a1695bbff833cf16a995c0cddb2f12

  • SHA256

    0940c0762d0cabc2ff674d835de0497708cb56c31d4a42c03255bfd8a038dbaf

  • SHA512

    2871e32e11fe4bf59eb57ab26b78a84fb969ca8d59e1433b59fca78ab7d6278bfd628508d2b65b7dbdbd529ed374712221bb5456578004e6d9d0d9005fc2f341

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0940c0762d0cabc2ff674d835de0497708cb56c31d4a42c03255bfd8a038dbaf

    • Size

      99KB

    • MD5

      1902b56184c4fb50e458005bad24e69b

    • SHA1

      96a11846d8a1695bbff833cf16a995c0cddb2f12

    • SHA256

      0940c0762d0cabc2ff674d835de0497708cb56c31d4a42c03255bfd8a038dbaf

    • SHA512

      2871e32e11fe4bf59eb57ab26b78a84fb969ca8d59e1433b59fca78ab7d6278bfd628508d2b65b7dbdbd529ed374712221bb5456578004e6d9d0d9005fc2f341

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks