Overview

overview

10

Static

static

10

08c468f424...62.exe

windows7_x64

10

08c468f424...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08c468f424b4548f603355f373344c63ffc097d308ec06cead3c2b9da9efe462

  • Size

    216KB

  • Sample

    220212-lwj76aagh9

  • MD5

    e836d654e01534e39fec95cb7387f6fb

  • SHA1

    fff7ba3b749d2c148da1ac27f83240f75254d054

  • SHA256

    08c468f424b4548f603355f373344c63ffc097d308ec06cead3c2b9da9efe462

  • SHA512

    e54fb6bcd8f87f67b57ca871f1ade181f0a722383ff51d2d0957726ecab7af67a0b461d2b6a38d77e482265415876ce0621b6e3a631088ee6e996b3a6b3307a4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08c468f424b4548f603355f373344c63ffc097d308ec06cead3c2b9da9efe462

    • Size

      216KB

    • MD5

      e836d654e01534e39fec95cb7387f6fb

    • SHA1

      fff7ba3b749d2c148da1ac27f83240f75254d054

    • SHA256

      08c468f424b4548f603355f373344c63ffc097d308ec06cead3c2b9da9efe462

    • SHA512

      e54fb6bcd8f87f67b57ca871f1ade181f0a722383ff51d2d0957726ecab7af67a0b461d2b6a38d77e482265415876ce0621b6e3a631088ee6e996b3a6b3307a4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks