Overview

overview

10

Static

static

055aea853f...c4.exe

windows7_x64

10

055aea853f...c4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    055aea853fcf4ef4afc81e12d3dfa2964a7bc86e27ebbea8d1eb56d84b5e93c4

  • Size

    60KB

  • Sample

    220212-m68tyabef7

  • MD5

    fd10dfbf5775359592c17766ff1cadcc

  • SHA1

    793d0d539b9f475787f4435cba2bb0e498e44233

  • SHA256

    055aea853fcf4ef4afc81e12d3dfa2964a7bc86e27ebbea8d1eb56d84b5e93c4

  • SHA512

    9aebff60714dd835453fdf352aa1bf8b89b31790113b43ba0e6acceb38f85546b088d63ef067439bdd71ac811c86b5170e7a0dc216d74781a5bcd76f0216bf51

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      055aea853fcf4ef4afc81e12d3dfa2964a7bc86e27ebbea8d1eb56d84b5e93c4

    • Size

      60KB

    • MD5

      fd10dfbf5775359592c17766ff1cadcc

    • SHA1

      793d0d539b9f475787f4435cba2bb0e498e44233

    • SHA256

      055aea853fcf4ef4afc81e12d3dfa2964a7bc86e27ebbea8d1eb56d84b5e93c4

    • SHA512

      9aebff60714dd835453fdf352aa1bf8b89b31790113b43ba0e6acceb38f85546b088d63ef067439bdd71ac811c86b5170e7a0dc216d74781a5bcd76f0216bf51

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks