Overview

overview

10

Static

static

10

05ad680f98...7b.exe

windows7_x64

10

05ad680f98...7b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05ad680f9881431a73f6aa609e19b0bf385bf2e985af73753310d217bdd2b27b

  • Size

    99KB

  • Sample

    220212-m2jn9abea8

  • MD5

    313fa82dc1b83a0756915abca5d9f385

  • SHA1

    e4759e4df56ff51f9b31affad9fe63ab57757206

  • SHA256

    05ad680f9881431a73f6aa609e19b0bf385bf2e985af73753310d217bdd2b27b

  • SHA512

    2b89f5c8af810346040a280e57ef3dbee5d0a055e5502b5dc48aafd82b6bfcb3adca8fdb2ebab401bdb71198bca98be125de8884f3665ad788416aa00c65c52c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05ad680f9881431a73f6aa609e19b0bf385bf2e985af73753310d217bdd2b27b

    • Size

      99KB

    • MD5

      313fa82dc1b83a0756915abca5d9f385

    • SHA1

      e4759e4df56ff51f9b31affad9fe63ab57757206

    • SHA256

      05ad680f9881431a73f6aa609e19b0bf385bf2e985af73753310d217bdd2b27b

    • SHA512

      2b89f5c8af810346040a280e57ef3dbee5d0a055e5502b5dc48aafd82b6bfcb3adca8fdb2ebab401bdb71198bca98be125de8884f3665ad788416aa00c65c52c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks