Overview

overview

10

Static

static

054edfc37c...cb.exe

windows7_x64

10

054edfc37c...cb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    054edfc37cb3f35329a5806f71695c1c431436fe717bbd10766f1b7543c700cb

  • Size

    60KB

  • Sample

    220212-m7tfmsdbhr

  • MD5

    a25aa6f50b91d9c1cd8a2f64412161fc

  • SHA1

    2efb5475b936368f22574ee1112c2d71514293da

  • SHA256

    054edfc37cb3f35329a5806f71695c1c431436fe717bbd10766f1b7543c700cb

  • SHA512

    6072e5de11e48b0c334120af5eeb39f7c3d9247dc44ede07a312deddeb8efd9781f5fa2c1b3521e17f8ad7b1677aa1b05ae3a6aab711ff384b05a949208f58eb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      054edfc37cb3f35329a5806f71695c1c431436fe717bbd10766f1b7543c700cb

    • Size

      60KB

    • MD5

      a25aa6f50b91d9c1cd8a2f64412161fc

    • SHA1

      2efb5475b936368f22574ee1112c2d71514293da

    • SHA256

      054edfc37cb3f35329a5806f71695c1c431436fe717bbd10766f1b7543c700cb

    • SHA512

      6072e5de11e48b0c334120af5eeb39f7c3d9247dc44ede07a312deddeb8efd9781f5fa2c1b3521e17f8ad7b1677aa1b05ae3a6aab711ff384b05a949208f58eb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks