Overview

overview

10

Static

static

053e1f5989...36.exe

windows7_x64

10

053e1f5989...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    053e1f5989a75ba2b5983adf6041cdca70899ded4aab1f61c8dd19e413c20436

  • Size

    35KB

  • Sample

    220212-m8skqsdcar

  • MD5

    8235305818cd665746af15a165301293

  • SHA1

    53d8b57276afbf9d8857d168d564733804af1153

  • SHA256

    053e1f5989a75ba2b5983adf6041cdca70899ded4aab1f61c8dd19e413c20436

  • SHA512

    d60f1dd98033a756fb2f950b84e028154060b6834c47713b8c0ce605f081d51848c258d81321e8185fa3cfb6f0bc609afddb2a4a1eac74cc59d92d69509510cc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      053e1f5989a75ba2b5983adf6041cdca70899ded4aab1f61c8dd19e413c20436

    • Size

      35KB

    • MD5

      8235305818cd665746af15a165301293

    • SHA1

      53d8b57276afbf9d8857d168d564733804af1153

    • SHA256

      053e1f5989a75ba2b5983adf6041cdca70899ded4aab1f61c8dd19e413c20436

    • SHA512

      d60f1dd98033a756fb2f950b84e028154060b6834c47713b8c0ce605f081d51848c258d81321e8185fa3cfb6f0bc609afddb2a4a1eac74cc59d92d69509510cc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks