Overview

overview

10

Static

static

10

0933e1eb8c...05.exe

windows7_x64

10

0933e1eb8c...05.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0933e1eb8c1527c7ba38cb2d59a32399ca0e98c5fccf2a8325c4e7a73622b805

  • Size

    100KB

  • Sample

    220212-lqds7aagc6

  • MD5

    e95b7fd642503edd63568d8a122552e4

  • SHA1

    627dcd8d09a461bdce72e5ab287d23714dad2cfa

  • SHA256

    0933e1eb8c1527c7ba38cb2d59a32399ca0e98c5fccf2a8325c4e7a73622b805

  • SHA512

    59f02bb6e55a550922a0a0dcd417d3553131e13474701a45ea02bd9ea803a8ce06f27f18e8b077d732e550354f1034cf94c3dfdc703dfa483da738738e6e3181

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0933e1eb8c1527c7ba38cb2d59a32399ca0e98c5fccf2a8325c4e7a73622b805

    • Size

      100KB

    • MD5

      e95b7fd642503edd63568d8a122552e4

    • SHA1

      627dcd8d09a461bdce72e5ab287d23714dad2cfa

    • SHA256

      0933e1eb8c1527c7ba38cb2d59a32399ca0e98c5fccf2a8325c4e7a73622b805

    • SHA512

      59f02bb6e55a550922a0a0dcd417d3553131e13474701a45ea02bd9ea803a8ce06f27f18e8b077d732e550354f1034cf94c3dfdc703dfa483da738738e6e3181

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks