Overview

overview

10

Static

static

10

05b822600d...e5.exe

windows7_x64

10

05b822600d...e5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05b822600da280dc6f936c67dbf3dad848ea4721947a6e9e7db3acf712294ae5

  • Size

    191KB

  • Sample

    220212-m1w8ysdbaq

  • MD5

    cb7912d0ba73a0db67f06935fe84cc69

  • SHA1

    fdb3263bdc1f8428983d68714f93e4ec649da7a3

  • SHA256

    05b822600da280dc6f936c67dbf3dad848ea4721947a6e9e7db3acf712294ae5

  • SHA512

    5ee2e79b6165e25d780407727e16e788485f7d6d88fe697bb8fc6f104bad6148afd8c1d4df0e1f89c6171f7727b64829286a232a76ba926fd165108802a52e09

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05b822600da280dc6f936c67dbf3dad848ea4721947a6e9e7db3acf712294ae5

    • Size

      191KB

    • MD5

      cb7912d0ba73a0db67f06935fe84cc69

    • SHA1

      fdb3263bdc1f8428983d68714f93e4ec649da7a3

    • SHA256

      05b822600da280dc6f936c67dbf3dad848ea4721947a6e9e7db3acf712294ae5

    • SHA512

      5ee2e79b6165e25d780407727e16e788485f7d6d88fe697bb8fc6f104bad6148afd8c1d4df0e1f89c6171f7727b64829286a232a76ba926fd165108802a52e09

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks