Overview

overview

10

Static

static

089f5a0c7b...25.exe

windows7_x64

10

089f5a0c7b...25.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925

  • Size

    60KB

  • Sample

    220212-lxqfkaahb5

  • MD5

    b87cc2abca0eda8e01106c1680afe3ed

  • SHA1

    779d7ab5059480018d2aed5e65b659b97ff36821

  • SHA256

    089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925

  • SHA512

    8e3e5ff01750c8f5aa858d1d6208643e173567296f1d56203443c68aa1af57a2b9ffd1b4985e9fcba274eb1c255182ad9a28a89ea9a353a9c845f0183f78441e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925

    • Size

      60KB

    • MD5

      b87cc2abca0eda8e01106c1680afe3ed

    • SHA1

      779d7ab5059480018d2aed5e65b659b97ff36821

    • SHA256

      089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925

    • SHA512

      8e3e5ff01750c8f5aa858d1d6208643e173567296f1d56203443c68aa1af57a2b9ffd1b4985e9fcba274eb1c255182ad9a28a89ea9a353a9c845f0183f78441e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks