Overview

overview

10

Static

static

10

08e1fa4701...9e.exe

windows7_x64

10

08e1fa4701...9e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08e1fa4701532e1c1b1fda7e5bbbdea0ab35710e9ac0d2bb075afa51c2f29f9e

  • Size

    100KB

  • Sample

    220212-lvksascdgp

  • MD5

    334ff728f1935d8607c2b32b67727f41

  • SHA1

    b35e95df0b965103f672e3b7fb33a39ba82990a2

  • SHA256

    08e1fa4701532e1c1b1fda7e5bbbdea0ab35710e9ac0d2bb075afa51c2f29f9e

  • SHA512

    42a61f8f692a9410421c581a5649c4f3d1929bf27fdc1ccc33ca3c6e39bec4ad5b4d7f1f0de16958af63269a4cf3dda2ddb3ecd67b3253937ff6d4c54f0d2e23

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08e1fa4701532e1c1b1fda7e5bbbdea0ab35710e9ac0d2bb075afa51c2f29f9e

    • Size

      100KB

    • MD5

      334ff728f1935d8607c2b32b67727f41

    • SHA1

      b35e95df0b965103f672e3b7fb33a39ba82990a2

    • SHA256

      08e1fa4701532e1c1b1fda7e5bbbdea0ab35710e9ac0d2bb075afa51c2f29f9e

    • SHA512

      42a61f8f692a9410421c581a5649c4f3d1929bf27fdc1ccc33ca3c6e39bec4ad5b4d7f1f0de16958af63269a4cf3dda2ddb3ecd67b3253937ff6d4c54f0d2e23

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks