Overview

overview

10

Static

static

07ad85b6bf...4d.exe

windows7_x64

10

07ad85b6bf...4d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07ad85b6bf8148b6a3acad5df5b83d8300a2786ea5a2722d94ab564a93099b4d

  • Size

    35KB

  • Sample

    220212-ma22hsbag2

  • MD5

    3ea00914d2d50cb71f29a8e26c35fde9

  • SHA1

    dc907c7aedab6ee77b1f307d244ad8f293801dbb

  • SHA256

    07ad85b6bf8148b6a3acad5df5b83d8300a2786ea5a2722d94ab564a93099b4d

  • SHA512

    7aee8083eb230e3fe10e81eca95601b55f9722dea6d379d30c9c93b445aa3dbb2e1677b0e939ee0fa66bde485d5006d6d1187867d0c96377d1702da477f1c97e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07ad85b6bf8148b6a3acad5df5b83d8300a2786ea5a2722d94ab564a93099b4d

    • Size

      35KB

    • MD5

      3ea00914d2d50cb71f29a8e26c35fde9

    • SHA1

      dc907c7aedab6ee77b1f307d244ad8f293801dbb

    • SHA256

      07ad85b6bf8148b6a3acad5df5b83d8300a2786ea5a2722d94ab564a93099b4d

    • SHA512

      7aee8083eb230e3fe10e81eca95601b55f9722dea6d379d30c9c93b445aa3dbb2e1677b0e939ee0fa66bde485d5006d6d1187867d0c96377d1702da477f1c97e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks