Overview

overview

10

Static

static

051b7a929b...03.exe

windows7_x64

10

051b7a929b...03.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    051b7a929bbc8cf480afb95c2316fe561cd5fc6e6e426371d8b335c625e77f03

  • Size

    36KB

  • Sample

    220212-m965hsdccn

  • MD5

    58368fd231daec65a67c13f6cce66edf

  • SHA1

    e689af48efae1317c41ac423411822fe506feee2

  • SHA256

    051b7a929bbc8cf480afb95c2316fe561cd5fc6e6e426371d8b335c625e77f03

  • SHA512

    8748fa0ec8a6aa5f998cc1b5ba36cc5201b77ca7783a66f8dbedd349c6c9970c97c3b8b49f7b0f44385beeacbfc382500dd92512c1d1d4341dd8be0a91fa1337

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      051b7a929bbc8cf480afb95c2316fe561cd5fc6e6e426371d8b335c625e77f03

    • Size

      36KB

    • MD5

      58368fd231daec65a67c13f6cce66edf

    • SHA1

      e689af48efae1317c41ac423411822fe506feee2

    • SHA256

      051b7a929bbc8cf480afb95c2316fe561cd5fc6e6e426371d8b335c625e77f03

    • SHA512

      8748fa0ec8a6aa5f998cc1b5ba36cc5201b77ca7783a66f8dbedd349c6c9970c97c3b8b49f7b0f44385beeacbfc382500dd92512c1d1d4341dd8be0a91fa1337

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks