Overview

overview

10

Static

static

10

053e65080b...2b.exe

windows7_x64

10

053e65080b...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    053e65080b67db748d678f788d643d395b75752176dab8e526897bfcbbb76e2b

  • Size

    200KB

  • Sample

    220212-m8qq5sbeh2

  • MD5

    e637f206cf38a98de72caca5f9ec206a

  • SHA1

    cbe428fc50a5c608c043e46e68eacac7b5081a81

  • SHA256

    053e65080b67db748d678f788d643d395b75752176dab8e526897bfcbbb76e2b

  • SHA512

    a41354bfebccf92094b3e6f8a298058c400053ff3c047fd70afee221b6bbf17647de3b84629ee209fb0eee5f0d9d54a53f7a6e8538921d6001cf2a48e88e85dc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      053e65080b67db748d678f788d643d395b75752176dab8e526897bfcbbb76e2b

    • Size

      200KB

    • MD5

      e637f206cf38a98de72caca5f9ec206a

    • SHA1

      cbe428fc50a5c608c043e46e68eacac7b5081a81

    • SHA256

      053e65080b67db748d678f788d643d395b75752176dab8e526897bfcbbb76e2b

    • SHA512

      a41354bfebccf92094b3e6f8a298058c400053ff3c047fd70afee221b6bbf17647de3b84629ee209fb0eee5f0d9d54a53f7a6e8538921d6001cf2a48e88e85dc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks