Overview

overview

10

Static

static

10

05786fde9d...97.exe

windows7_x64

10

05786fde9d...97.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05786fde9d0078bfff54a13b8b38e8e44dc9d37bd5145e1a7f1d3bc85a040f97

  • Size

    92KB

  • Sample

    220212-m5cecabed4

  • MD5

    4416e0ff5051534242873a6a0696a294

  • SHA1

    067f336a4cbb6f03350b534eab1e24d060c6431d

  • SHA256

    05786fde9d0078bfff54a13b8b38e8e44dc9d37bd5145e1a7f1d3bc85a040f97

  • SHA512

    71e613199b47eefb147b3a24aecd9402550b368589fdf193d942ad0ef5af2534161576f7229daa5ecc27ec9e80233749ed073652aa8e660e820754a7063b2f79

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05786fde9d0078bfff54a13b8b38e8e44dc9d37bd5145e1a7f1d3bc85a040f97

    • Size

      92KB

    • MD5

      4416e0ff5051534242873a6a0696a294

    • SHA1

      067f336a4cbb6f03350b534eab1e24d060c6431d

    • SHA256

      05786fde9d0078bfff54a13b8b38e8e44dc9d37bd5145e1a7f1d3bc85a040f97

    • SHA512

      71e613199b47eefb147b3a24aecd9402550b368589fdf193d942ad0ef5af2534161576f7229daa5ecc27ec9e80233749ed073652aa8e660e820754a7063b2f79

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks