Overview

overview

10

Static

static

05a1e9a55c...3d.exe

windows7_x64

10

05a1e9a55c...3d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05a1e9a55cf6a536b4a21cf5384cecd2ef03fbd45beb0a860d666d9b15b5be3d

  • Size

    60KB

  • Sample

    220212-m22j3abeb5

  • MD5

    870c4f35c986c08f830e5029fdece14a

  • SHA1

    7247575b3805884950b3650342e61e1783795055

  • SHA256

    05a1e9a55cf6a536b4a21cf5384cecd2ef03fbd45beb0a860d666d9b15b5be3d

  • SHA512

    487b811e5e967f01636e5954f5439c16a10d764a254a5199fe133bff666d30cfad7ca423bcc4cf067f83ca87a1f230fe5dbc96deaa2e7f8627b1d18a4f401949

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05a1e9a55cf6a536b4a21cf5384cecd2ef03fbd45beb0a860d666d9b15b5be3d

    • Size

      60KB

    • MD5

      870c4f35c986c08f830e5029fdece14a

    • SHA1

      7247575b3805884950b3650342e61e1783795055

    • SHA256

      05a1e9a55cf6a536b4a21cf5384cecd2ef03fbd45beb0a860d666d9b15b5be3d

    • SHA512

      487b811e5e967f01636e5954f5439c16a10d764a254a5199fe133bff666d30cfad7ca423bcc4cf067f83ca87a1f230fe5dbc96deaa2e7f8627b1d18a4f401949

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks