Overview

overview

10

Static

static

10

058cc71ac7...0e.exe

windows7_x64

10

058cc71ac7...0e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    058cc71ac7237011ed7fa6dce18dc942f900a835008d699e456004f3819ed60e

  • Size

    99KB

  • Sample

    220212-m39basdbej

  • MD5

    160672a009409f99924d8c3fa57b7179

  • SHA1

    fe6e102590e30afe0a35175837b983c61f54a0dd

  • SHA256

    058cc71ac7237011ed7fa6dce18dc942f900a835008d699e456004f3819ed60e

  • SHA512

    460488c0754af38139086ec4838eed4e86f253f2ee60e7c3b2117b4312fccdcb56d7b2ca65e97ba44790dac9c87e306c29ca884c5885f4f0268b981a4332fe2b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      058cc71ac7237011ed7fa6dce18dc942f900a835008d699e456004f3819ed60e

    • Size

      99KB

    • MD5

      160672a009409f99924d8c3fa57b7179

    • SHA1

      fe6e102590e30afe0a35175837b983c61f54a0dd

    • SHA256

      058cc71ac7237011ed7fa6dce18dc942f900a835008d699e456004f3819ed60e

    • SHA512

      460488c0754af38139086ec4838eed4e86f253f2ee60e7c3b2117b4312fccdcb56d7b2ca65e97ba44790dac9c87e306c29ca884c5885f4f0268b981a4332fe2b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks