Overview

overview

10

Static

static

094a46a0e3...02.exe

windows7_x64

10

094a46a0e3...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    094a46a0e3054265adcc4b7a1c4543b1652fcfb29f2aead26ee33acf94931102

  • Size

    60KB

  • Sample

    220212-lnrl9sagb3

  • MD5

    c38a957dc4f8152b98d5e4081a875e7e

  • SHA1

    4e91fea2b481d441f09fcec5def389b7069f1f14

  • SHA256

    094a46a0e3054265adcc4b7a1c4543b1652fcfb29f2aead26ee33acf94931102

  • SHA512

    e1a415cf7928396731442b4224f724f8ecf83be1934e5e5a4236ff3d3e7ca5e2aa0aa31320b8600d897b4997606d342fc1148ee6a4f18e9cdb84d7181b02f814

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      094a46a0e3054265adcc4b7a1c4543b1652fcfb29f2aead26ee33acf94931102

    • Size

      60KB

    • MD5

      c38a957dc4f8152b98d5e4081a875e7e

    • SHA1

      4e91fea2b481d441f09fcec5def389b7069f1f14

    • SHA256

      094a46a0e3054265adcc4b7a1c4543b1652fcfb29f2aead26ee33acf94931102

    • SHA512

      e1a415cf7928396731442b4224f724f8ecf83be1934e5e5a4236ff3d3e7ca5e2aa0aa31320b8600d897b4997606d342fc1148ee6a4f18e9cdb84d7181b02f814

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks