Overview

overview

10

Static

static

08e26016ec...30.exe

windows7_x64

10

08e26016ec...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08e26016ec263ec6b689bb2c02e30b1421baefcba9bab32c82658c23a4ecc430

  • Size

    35KB

  • Sample

    220212-lvhmyaagg7

  • MD5

    bfc398516e263aec273534003a389688

  • SHA1

    57cc3a492876278bf1f5cdaaf42e8c49f40286b2

  • SHA256

    08e26016ec263ec6b689bb2c02e30b1421baefcba9bab32c82658c23a4ecc430

  • SHA512

    896301ed1b18d68b74554299ab63a427764be1788e3fe12c536f5693542e8a2cbe837683bd54590de0a6511f56f4797349d20922dfbc72dc202c61af94288ccb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08e26016ec263ec6b689bb2c02e30b1421baefcba9bab32c82658c23a4ecc430

    • Size

      35KB

    • MD5

      bfc398516e263aec273534003a389688

    • SHA1

      57cc3a492876278bf1f5cdaaf42e8c49f40286b2

    • SHA256

      08e26016ec263ec6b689bb2c02e30b1421baefcba9bab32c82658c23a4ecc430

    • SHA512

      896301ed1b18d68b74554299ab63a427764be1788e3fe12c536f5693542e8a2cbe837683bd54590de0a6511f56f4797349d20922dfbc72dc202c61af94288ccb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks