Overview

overview

10

Static

static

10

053eedd8dd...8b.exe

windows7_x64

10

053eedd8dd...8b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    053eedd8dd3e393652046d116f2a312147be406f8c3bdf16b56bf5a4f9d4b38b

  • Size

    150KB

  • Sample

    220212-m8h2asbeg7

  • MD5

    4bd1cdab0745ae149ca5d643ec8ae92c

  • SHA1

    e4b448e4514c3ea18a7b8aa7a20e11a83d54c745

  • SHA256

    053eedd8dd3e393652046d116f2a312147be406f8c3bdf16b56bf5a4f9d4b38b

  • SHA512

    ddce73f4c700f77d121a180bb592de64ff1481a0526dbebc1352420106074ec293bc8f30a9de211c6ee2beac63fb1f6af3c6ea077016cf7205a7ecc66ee956bc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      053eedd8dd3e393652046d116f2a312147be406f8c3bdf16b56bf5a4f9d4b38b

    • Size

      150KB

    • MD5

      4bd1cdab0745ae149ca5d643ec8ae92c

    • SHA1

      e4b448e4514c3ea18a7b8aa7a20e11a83d54c745

    • SHA256

      053eedd8dd3e393652046d116f2a312147be406f8c3bdf16b56bf5a4f9d4b38b

    • SHA512

      ddce73f4c700f77d121a180bb592de64ff1481a0526dbebc1352420106074ec293bc8f30a9de211c6ee2beac63fb1f6af3c6ea077016cf7205a7ecc66ee956bc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks