Overview

overview

10

Static

static

05b6b136ff...b2.exe

windows7_x64

10

05b6b136ff...b2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05b6b136fff575e1aa8cabf9314a7abea100e3d66d230f62b776fd9964ab3fb2

  • Size

    36KB

  • Sample

    220212-m14m2adbbk

  • MD5

    9ecb378d27964fc4f79ab59fb6eee057

  • SHA1

    3dcfdf4b78d1d32efd221f2a143595f2eb0b0d6f

  • SHA256

    05b6b136fff575e1aa8cabf9314a7abea100e3d66d230f62b776fd9964ab3fb2

  • SHA512

    723f3bffc4df9805d77147c1b3513bbc8c4721b6a1705c794c73e342b0852cc17e22312327302182881d971365cf4677a44b8fc6d9fc8186f167a0b66ea5bf95

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05b6b136fff575e1aa8cabf9314a7abea100e3d66d230f62b776fd9964ab3fb2

    • Size

      36KB

    • MD5

      9ecb378d27964fc4f79ab59fb6eee057

    • SHA1

      3dcfdf4b78d1d32efd221f2a143595f2eb0b0d6f

    • SHA256

      05b6b136fff575e1aa8cabf9314a7abea100e3d66d230f62b776fd9964ab3fb2

    • SHA512

      723f3bffc4df9805d77147c1b3513bbc8c4721b6a1705c794c73e342b0852cc17e22312327302182881d971365cf4677a44b8fc6d9fc8186f167a0b66ea5bf95

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks