Overview

overview

10

Static

static

08a67c5b93...fb.exe

windows7_x64

10

08a67c5b93...fb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08a67c5b9324b00b99813d59133fd931f0b695209b91ebf516e43f8e2c8fa2fb

  • Size

    60KB

  • Sample

    220212-lxghnaaha9

  • MD5

    93c5011751d5b48d9bb4596c10555a96

  • SHA1

    4b9db58b326a85566b6349c9a6d549218ddaf71f

  • SHA256

    08a67c5b9324b00b99813d59133fd931f0b695209b91ebf516e43f8e2c8fa2fb

  • SHA512

    1e1df8e00ecdad885885562b4b17b7c5999ad5f1a271a135f0408090c0773a1b6f7336d7ece59461f5c65def920b1f08017418c06f70d9d624a3ce2178931a28

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      08a67c5b9324b00b99813d59133fd931f0b695209b91ebf516e43f8e2c8fa2fb

    • Size

      60KB

    • MD5

      93c5011751d5b48d9bb4596c10555a96

    • SHA1

      4b9db58b326a85566b6349c9a6d549218ddaf71f

    • SHA256

      08a67c5b9324b00b99813d59133fd931f0b695209b91ebf516e43f8e2c8fa2fb

    • SHA512

      1e1df8e00ecdad885885562b4b17b7c5999ad5f1a271a135f0408090c0773a1b6f7336d7ece59461f5c65def920b1f08017418c06f70d9d624a3ce2178931a28

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks