Overview

overview

10

Static

static

05b3615a82...f6.exe

windows7_x64

10

05b3615a82...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05b3615a82b17f065c872f8e3f89c3f53d0abdcad382f56e307ce92f43c9d2f6

  • Size

    36KB

  • Sample

    220212-m16gmadbbl

  • MD5

    8b95082948914308597d0abe961fc52b

  • SHA1

    62c4029fd209ed3743708f78ebdcda0c5eaeab2f

  • SHA256

    05b3615a82b17f065c872f8e3f89c3f53d0abdcad382f56e307ce92f43c9d2f6

  • SHA512

    54543f1c614a83b16d0de6dc08ac10358108d36b239b387c9258fbaaf00b8d9260376338413cf32663c63e49c1b5926c293fbe342a3560b678e81cc876a215ba

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05b3615a82b17f065c872f8e3f89c3f53d0abdcad382f56e307ce92f43c9d2f6

    • Size

      36KB

    • MD5

      8b95082948914308597d0abe961fc52b

    • SHA1

      62c4029fd209ed3743708f78ebdcda0c5eaeab2f

    • SHA256

      05b3615a82b17f065c872f8e3f89c3f53d0abdcad382f56e307ce92f43c9d2f6

    • SHA512

      54543f1c614a83b16d0de6dc08ac10358108d36b239b387c9258fbaaf00b8d9260376338413cf32663c63e49c1b5926c293fbe342a3560b678e81cc876a215ba

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks