Overview

overview

10

Static

static

0528cf7316...ca.exe

windows7_x64

10

0528cf7316...ca.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0528cf731605934b62c8de37f9240c25473b5342cf78ae30548e510917b77dca

  • Size

    60KB

  • Sample

    220212-m9nyyabfa2

  • MD5

    682d20ac94a79295588adf105a53afd8

  • SHA1

    66a30507fa25d4df3341bae47e01123492afab62

  • SHA256

    0528cf731605934b62c8de37f9240c25473b5342cf78ae30548e510917b77dca

  • SHA512

    547dbae5e9b7e20e062f23ce689a48569b992fb469efa4f44c5d2871349d351a1e6a338f4cb769adf4d122bcf4e456bd42216035241893ceb18739e9f10af79d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0528cf731605934b62c8de37f9240c25473b5342cf78ae30548e510917b77dca

    • Size

      60KB

    • MD5

      682d20ac94a79295588adf105a53afd8

    • SHA1

      66a30507fa25d4df3341bae47e01123492afab62

    • SHA256

      0528cf731605934b62c8de37f9240c25473b5342cf78ae30548e510917b77dca

    • SHA512

      547dbae5e9b7e20e062f23ce689a48569b992fb469efa4f44c5d2871349d351a1e6a338f4cb769adf4d122bcf4e456bd42216035241893ceb18739e9f10af79d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks