Overview

overview

10

Static

static

0530fe372a...b4.exe

windows7_x64

10

0530fe372a...b4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0530fe372aead8e7ccae72b45f79646d9251f6957d7e6a06bafd51304dfceab4

  • Size

    36KB

  • Sample

    220212-m9c7fadcbn

  • MD5

    ae86f4a82e9c3877a506c95dec0c82ee

  • SHA1

    fd51619014d5dfd8378567caefe26f85fa069517

  • SHA256

    0530fe372aead8e7ccae72b45f79646d9251f6957d7e6a06bafd51304dfceab4

  • SHA512

    8103e406dec2432d5b995bafa1ab77143bcf9fd694368ebb8b6896e138ac9137015bdbbc7035ae224fefdf79a1c42ebb24d254a5e769b42f05b8aad73a654e0c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0530fe372aead8e7ccae72b45f79646d9251f6957d7e6a06bafd51304dfceab4

    • Size

      36KB

    • MD5

      ae86f4a82e9c3877a506c95dec0c82ee

    • SHA1

      fd51619014d5dfd8378567caefe26f85fa069517

    • SHA256

      0530fe372aead8e7ccae72b45f79646d9251f6957d7e6a06bafd51304dfceab4

    • SHA512

      8103e406dec2432d5b995bafa1ab77143bcf9fd694368ebb8b6896e138ac9137015bdbbc7035ae224fefdf79a1c42ebb24d254a5e769b42f05b8aad73a654e0c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks