Overview

overview

10

Static

static

10

07a6db54d2...ce.exe

windows7_x64

10

07a6db54d2...ce.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07a6db54d29df600055bcba83e3d4313113e99fe453eb2330faef778581f04ce

  • Size

    191KB

  • Sample

    220212-mb4xhacgaq

  • MD5

    159255944d0d4ee905ad89a82efa7bf4

  • SHA1

    266bb2c97ced484755ad5f1fbf6d12dc23f754a0

  • SHA256

    07a6db54d29df600055bcba83e3d4313113e99fe453eb2330faef778581f04ce

  • SHA512

    87c598c79614e387c48886ba092eb13d36a1e74ed7d1195be5cf5f951f5bef722fc05a61cc0cd55f4b2867034953a370f44d2ee0dacdbe23cc9d5e22d14ca925

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07a6db54d29df600055bcba83e3d4313113e99fe453eb2330faef778581f04ce

    • Size

      191KB

    • MD5

      159255944d0d4ee905ad89a82efa7bf4

    • SHA1

      266bb2c97ced484755ad5f1fbf6d12dc23f754a0

    • SHA256

      07a6db54d29df600055bcba83e3d4313113e99fe453eb2330faef778581f04ce

    • SHA512

      87c598c79614e387c48886ba092eb13d36a1e74ed7d1195be5cf5f951f5bef722fc05a61cc0cd55f4b2867034953a370f44d2ee0dacdbe23cc9d5e22d14ca925

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks