Overview

overview

10

Static

static

10

07b23e683a...ee.exe

windows7_x64

10

07b23e683a...ee.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07b23e683ab5cf55af6c375cb76d25b143b2484eaf2482b8f6edfdc1cb5798ee

  • Size

    88KB

  • Sample

    220212-massvabaf8

  • MD5

    1966002002b8595ff53907ca89d209dc

  • SHA1

    906484497b5727f082b06462c84f2db0e5dc4167

  • SHA256

    07b23e683ab5cf55af6c375cb76d25b143b2484eaf2482b8f6edfdc1cb5798ee

  • SHA512

    dc4733c94b4ec9ff5cb5f22e70e601987d5b05f8b6d82c5af983237cd3aa775a24108a1616d10a07131b7751a60ece85540c050e1049d24f856f0f79a47251e1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07b23e683ab5cf55af6c375cb76d25b143b2484eaf2482b8f6edfdc1cb5798ee

    • Size

      88KB

    • MD5

      1966002002b8595ff53907ca89d209dc

    • SHA1

      906484497b5727f082b06462c84f2db0e5dc4167

    • SHA256

      07b23e683ab5cf55af6c375cb76d25b143b2484eaf2482b8f6edfdc1cb5798ee

    • SHA512

      dc4733c94b4ec9ff5cb5f22e70e601987d5b05f8b6d82c5af983237cd3aa775a24108a1616d10a07131b7751a60ece85540c050e1049d24f856f0f79a47251e1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks