Overview

overview

10

Static

static

10

09010ff41f...9b.exe

windows7_x64

10

09010ff41f...9b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09010ff41f2fb511aca9271f2fd90bf48b70fd50f0db6948291ce5d3dba9e09b

  • Size

    99KB

  • Sample

    220212-ls996sagf3

  • MD5

    8ae65bad75c6361b48ce6287d46995bd

  • SHA1

    ebb8900049f4d3f249a5ca1e251f541622230b8d

  • SHA256

    09010ff41f2fb511aca9271f2fd90bf48b70fd50f0db6948291ce5d3dba9e09b

  • SHA512

    f49efdfbfbcd5f5f021df2994e78a6837334876da95c284e10b4d21c0074a7134e5ef09ec66c6e9b0b483d1750e8314edce4e9b3a2da93aba3b1bfc5dc39665d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      09010ff41f2fb511aca9271f2fd90bf48b70fd50f0db6948291ce5d3dba9e09b

    • Size

      99KB

    • MD5

      8ae65bad75c6361b48ce6287d46995bd

    • SHA1

      ebb8900049f4d3f249a5ca1e251f541622230b8d

    • SHA256

      09010ff41f2fb511aca9271f2fd90bf48b70fd50f0db6948291ce5d3dba9e09b

    • SHA512

      f49efdfbfbcd5f5f021df2994e78a6837334876da95c284e10b4d21c0074a7134e5ef09ec66c6e9b0b483d1750e8314edce4e9b3a2da93aba3b1bfc5dc39665d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks