Overview

overview

10

Static

static

10

08f8983c37...7d.exe

windows7_x64

10

08f8983c37...7d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08f8983c37e1eff0e2b361b6b85ee767630fa1e594596fc4d4d28d124f8be77d

  • Size

    101KB

  • Sample

    220212-ltvk4scdgj

  • MD5

    4a641165c2e9a70eca25ccbfc8934847

  • SHA1

    6661bb3fc1d80487eb272f41804c1447abd40189

  • SHA256

    08f8983c37e1eff0e2b361b6b85ee767630fa1e594596fc4d4d28d124f8be77d

  • SHA512

    32cfa3c3fd60ebaf69a17973f2200cde9cc7dbe9701c5e9df63e3d5501210a4df7e5da2e8cb29cccc89d5d13fa96a8cd453d8940f7425f45a972990ff24b92b3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08f8983c37e1eff0e2b361b6b85ee767630fa1e594596fc4d4d28d124f8be77d

    • Size

      101KB

    • MD5

      4a641165c2e9a70eca25ccbfc8934847

    • SHA1

      6661bb3fc1d80487eb272f41804c1447abd40189

    • SHA256

      08f8983c37e1eff0e2b361b6b85ee767630fa1e594596fc4d4d28d124f8be77d

    • SHA512

      32cfa3c3fd60ebaf69a17973f2200cde9cc7dbe9701c5e9df63e3d5501210a4df7e5da2e8cb29cccc89d5d13fa96a8cd453d8940f7425f45a972990ff24b92b3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks