Overview

overview

10

Static

static

10

09044bee77...d4.exe

windows7_x64

10

09044bee77...d4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09044bee77d7dbffd38e64c880414caa115519c322e799227ea44c372138c0d4

  • Size

    80KB

  • Sample

    220212-ls2b9sage9

  • MD5

    e7007819d1e7c0533b3ba6ec56d1c56e

  • SHA1

    c7dcf1c550c5ae18ea9baa4ffbba5b23b00bdc0e

  • SHA256

    09044bee77d7dbffd38e64c880414caa115519c322e799227ea44c372138c0d4

  • SHA512

    2fdb8841f30fc0192e82769b00008c36ded0c0123f303672cb54b2ff2b32841384c78508f7e1b53cf2c4c9a1493776df6240b6ffdd5e91adddc8a523dea4a272

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09044bee77d7dbffd38e64c880414caa115519c322e799227ea44c372138c0d4

    • Size

      80KB

    • MD5

      e7007819d1e7c0533b3ba6ec56d1c56e

    • SHA1

      c7dcf1c550c5ae18ea9baa4ffbba5b23b00bdc0e

    • SHA256

      09044bee77d7dbffd38e64c880414caa115519c322e799227ea44c372138c0d4

    • SHA512

      2fdb8841f30fc0192e82769b00008c36ded0c0123f303672cb54b2ff2b32841384c78508f7e1b53cf2c4c9a1493776df6240b6ffdd5e91adddc8a523dea4a272

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks