Overview

overview

10

Static

static

10

087d856c36...d5.exe

windows7_x64

10

087d856c36...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    087d856c3686283e3a1f9b4bfac231971a047254cfc6342e9a4b84f73fe626d5

  • Size

    176KB

  • Sample

    220212-lzrreaahc9

  • MD5

    27aeec117b2c0cee1145d4aa287ac800

  • SHA1

    d711a3fc88b1909a3c6ce0bfea2db7c187d5f0e1

  • SHA256

    087d856c3686283e3a1f9b4bfac231971a047254cfc6342e9a4b84f73fe626d5

  • SHA512

    74f6f1fd426ddd63c99f92a4186b8ed2a0f7bf69b67297d941c4743d109d0491f808ddf0d625b8ae8ab9670beef8bc35c6c62657c4f177853c8d53d9b0bd2265

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      087d856c3686283e3a1f9b4bfac231971a047254cfc6342e9a4b84f73fe626d5

    • Size

      176KB

    • MD5

      27aeec117b2c0cee1145d4aa287ac800

    • SHA1

      d711a3fc88b1909a3c6ce0bfea2db7c187d5f0e1

    • SHA256

      087d856c3686283e3a1f9b4bfac231971a047254cfc6342e9a4b84f73fe626d5

    • SHA512

      74f6f1fd426ddd63c99f92a4186b8ed2a0f7bf69b67297d941c4743d109d0491f808ddf0d625b8ae8ab9670beef8bc35c6c62657c4f177853c8d53d9b0bd2265

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks