Overview

overview

10

Static

static

10

053b945c76...4e.exe

windows7_x64

10

053b945c76...4e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    053b945c76c5cde043fe8c46069d6dae3cc5ed03e5302301d4e0b36ed87bc24e

  • Size

    100KB

  • Sample

    220212-m8xjpabeh4

  • MD5

    8f854aec672d051a1a3c6859b9ce84f3

  • SHA1

    ccbb2f19bf04b9c190ba21e4d0db7dc2ab22d307

  • SHA256

    053b945c76c5cde043fe8c46069d6dae3cc5ed03e5302301d4e0b36ed87bc24e

  • SHA512

    0af5e2038956770464fa84afed6807bdff61cb9a5f858bce16373128d474ac52805d6567e903236d11f911710f7d6225c6919b81c0b6123a5ae8b13a86f6b603

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      053b945c76c5cde043fe8c46069d6dae3cc5ed03e5302301d4e0b36ed87bc24e

    • Size

      100KB

    • MD5

      8f854aec672d051a1a3c6859b9ce84f3

    • SHA1

      ccbb2f19bf04b9c190ba21e4d0db7dc2ab22d307

    • SHA256

      053b945c76c5cde043fe8c46069d6dae3cc5ed03e5302301d4e0b36ed87bc24e

    • SHA512

      0af5e2038956770464fa84afed6807bdff61cb9a5f858bce16373128d474ac52805d6567e903236d11f911710f7d6225c6919b81c0b6123a5ae8b13a86f6b603

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks