Overview

overview

10

Static

static

10

05aad4b72b...b9.exe

windows7_x64

10

05aad4b72b...b9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05aad4b72bf22fed306933e57e1e679a0822321efeba7bea1f2d8aad023b9db9

  • Size

    89KB

  • Sample

    220212-m2nm7sbea9

  • MD5

    254a49bc586631c4337606a8ed0c4390

  • SHA1

    c5eb34bd5f3ccdfd399b0598681f51e3a0452330

  • SHA256

    05aad4b72bf22fed306933e57e1e679a0822321efeba7bea1f2d8aad023b9db9

  • SHA512

    51a3c616ed5b7d15f45fe493f81fd5e299e0354d17072c7d0ab852d8ea2f511a1b5f7b12d54190fd1d26802229a008413b070de07aef8c2ce8e8bf2b54b8e850

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05aad4b72bf22fed306933e57e1e679a0822321efeba7bea1f2d8aad023b9db9

    • Size

      89KB

    • MD5

      254a49bc586631c4337606a8ed0c4390

    • SHA1

      c5eb34bd5f3ccdfd399b0598681f51e3a0452330

    • SHA256

      05aad4b72bf22fed306933e57e1e679a0822321efeba7bea1f2d8aad023b9db9

    • SHA512

      51a3c616ed5b7d15f45fe493f81fd5e299e0354d17072c7d0ab852d8ea2f511a1b5f7b12d54190fd1d26802229a008413b070de07aef8c2ce8e8bf2b54b8e850

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks