Overview

overview

10

Static

static

05cbdd9df3...ff.exe

windows7_x64

10

05cbdd9df3...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05cbdd9df3abcadd7be8ebd9c7c7de2602bfad0a31e0bd06ecf0be50c0d8a8ff

  • Size

    60KB

  • Sample

    220212-m1ghhabdh8

  • MD5

    62ec3ce06826523e5bf87ac579fba81b

  • SHA1

    f9544c12764dce9dd6ac8f0ad8668739e45fddb9

  • SHA256

    05cbdd9df3abcadd7be8ebd9c7c7de2602bfad0a31e0bd06ecf0be50c0d8a8ff

  • SHA512

    e866376c8efb92e62ae2ad8569f978eefbdb853c12d6b58328e904bfbe0bad412ceef432d1500d642ee0faf2f6a97de87d49b3f8e8055c50fa5870e60fd6f66f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05cbdd9df3abcadd7be8ebd9c7c7de2602bfad0a31e0bd06ecf0be50c0d8a8ff

    • Size

      60KB

    • MD5

      62ec3ce06826523e5bf87ac579fba81b

    • SHA1

      f9544c12764dce9dd6ac8f0ad8668739e45fddb9

    • SHA256

      05cbdd9df3abcadd7be8ebd9c7c7de2602bfad0a31e0bd06ecf0be50c0d8a8ff

    • SHA512

      e866376c8efb92e62ae2ad8569f978eefbdb853c12d6b58328e904bfbe0bad412ceef432d1500d642ee0faf2f6a97de87d49b3f8e8055c50fa5870e60fd6f66f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks