Overview

overview

10

Static

static

10

08f831b2ea...1e.exe

windows7_x64

10

08f831b2ea...1e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08f831b2eaf0b0fc02902687ac6c4089055669909d5a6b5eb47489fb5c31a81e

  • Size

    150KB

  • Sample

    220212-ltz6laagf9

  • MD5

    45a59e898618704b66dc0151d444145d

  • SHA1

    f532bd7c9eeed0701f2567b98f07d81014d2bbd0

  • SHA256

    08f831b2eaf0b0fc02902687ac6c4089055669909d5a6b5eb47489fb5c31a81e

  • SHA512

    4cbe37bc3a8e041c352ea77158cd6af27293617d0ec60d3882408d4ba865959997fc35ee06efb8e4c0a4d15b166e3811d073754475852ee915f9dbeea94bd2dc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08f831b2eaf0b0fc02902687ac6c4089055669909d5a6b5eb47489fb5c31a81e

    • Size

      150KB

    • MD5

      45a59e898618704b66dc0151d444145d

    • SHA1

      f532bd7c9eeed0701f2567b98f07d81014d2bbd0

    • SHA256

      08f831b2eaf0b0fc02902687ac6c4089055669909d5a6b5eb47489fb5c31a81e

    • SHA512

      4cbe37bc3a8e041c352ea77158cd6af27293617d0ec60d3882408d4ba865959997fc35ee06efb8e4c0a4d15b166e3811d073754475852ee915f9dbeea94bd2dc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks