Overview

overview

10

Static

static

05937633c4...7e.exe

windows7_x64

10

05937633c4...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05937633c4d1ea76f830c7c68e6392d55ca4980928825ec8618cce96a901947e

  • Size

    60KB

  • Sample

    220212-m3s93sbeb8

  • MD5

    8e0bf21fa1e07852ec579bd6f065c3b7

  • SHA1

    8de87ed0025c95b3cc59222fce8c6f2df0b594bc

  • SHA256

    05937633c4d1ea76f830c7c68e6392d55ca4980928825ec8618cce96a901947e

  • SHA512

    9a6781a12c7b52f5ee0ced0a1ddfb97ece0df4ed4c559d6185da7ff22ff27cd55f561b3a9c849b702fda91f11c54f01acf4c032c2e4628da94ff226da68e40e9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05937633c4d1ea76f830c7c68e6392d55ca4980928825ec8618cce96a901947e

    • Size

      60KB

    • MD5

      8e0bf21fa1e07852ec579bd6f065c3b7

    • SHA1

      8de87ed0025c95b3cc59222fce8c6f2df0b594bc

    • SHA256

      05937633c4d1ea76f830c7c68e6392d55ca4980928825ec8618cce96a901947e

    • SHA512

      9a6781a12c7b52f5ee0ced0a1ddfb97ece0df4ed4c559d6185da7ff22ff27cd55f561b3a9c849b702fda91f11c54f01acf4c032c2e4628da94ff226da68e40e9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks