Overview

overview

10

Static

static

057db5b5cb...30.exe

windows7_x64

10

057db5b5cb...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830

  • Size

    60KB

  • Sample

    220212-m4y7qabec9

  • MD5

    85d9c7207ef1464b6ebaad26678ee697

  • SHA1

    60d5f3d2bb01069ee55b47e495d62676acd63ce5

  • SHA256

    057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830

  • SHA512

    c4e1a653b13a737462d07f5b88c7b2e0022dc9169ac3c0a92d681e1b5ea2395b6c4751f690344eaf32a959ecaef65a4df841b8dfcd9b89809c988d2084763a4e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830

    • Size

      60KB

    • MD5

      85d9c7207ef1464b6ebaad26678ee697

    • SHA1

      60d5f3d2bb01069ee55b47e495d62676acd63ce5

    • SHA256

      057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830

    • SHA512

      c4e1a653b13a737462d07f5b88c7b2e0022dc9169ac3c0a92d681e1b5ea2395b6c4751f690344eaf32a959ecaef65a4df841b8dfcd9b89809c988d2084763a4e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks