Overview

overview

10

Static

static

10

05cee53634...a2.exe

windows7_x64

10

05cee53634...a2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05cee536343c5f304da1de87807def26044abff66f80d2d838c480b6d4bc3da2

  • Size

    89KB

  • Sample

    220212-m1ad7abdh6

  • MD5

    5289c096ba8c9df9922d4dfb6f314f3d

  • SHA1

    59ed82b00bb50f36e93173310e4bb49d5fe5ba90

  • SHA256

    05cee536343c5f304da1de87807def26044abff66f80d2d838c480b6d4bc3da2

  • SHA512

    87a0c5e1f800b37098f590bb44e367a27bc15862bdb20550dadb263b64ef55a6f660d183d0d06543829a6c61461d59c6f5fb51e1732206ae9ee63302df33130f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05cee536343c5f304da1de87807def26044abff66f80d2d838c480b6d4bc3da2

    • Size

      89KB

    • MD5

      5289c096ba8c9df9922d4dfb6f314f3d

    • SHA1

      59ed82b00bb50f36e93173310e4bb49d5fe5ba90

    • SHA256

      05cee536343c5f304da1de87807def26044abff66f80d2d838c480b6d4bc3da2

    • SHA512

      87a0c5e1f800b37098f590bb44e367a27bc15862bdb20550dadb263b64ef55a6f660d183d0d06543829a6c61461d59c6f5fb51e1732206ae9ee63302df33130f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks