Overview

overview

10

Static

static

10

07aa88884e...25.exe

windows7_x64

10

07aa88884e...25.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07aa88884e351c13cfb2001ddbd7c8e47a4ae4e5621b8f123e07ea9c6d362525

  • Size

    216KB

  • Sample

    220212-mbmm8abag7

  • MD5

    e7794f60bf0495c94471ba3ad08c4050

  • SHA1

    d65d116567a380c73c3f567ce59c99caca01a5c9

  • SHA256

    07aa88884e351c13cfb2001ddbd7c8e47a4ae4e5621b8f123e07ea9c6d362525

  • SHA512

    dd2f7c75bb562a0ec2d52c8b261a894c8a1ffa135bc012490b4c11cc15e4c027b4b6e6e2c1a97f181e331231d391df306f5b2e365d78203a74137fb7f9a92161

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07aa88884e351c13cfb2001ddbd7c8e47a4ae4e5621b8f123e07ea9c6d362525

    • Size

      216KB

    • MD5

      e7794f60bf0495c94471ba3ad08c4050

    • SHA1

      d65d116567a380c73c3f567ce59c99caca01a5c9

    • SHA256

      07aa88884e351c13cfb2001ddbd7c8e47a4ae4e5621b8f123e07ea9c6d362525

    • SHA512

      dd2f7c75bb562a0ec2d52c8b261a894c8a1ffa135bc012490b4c11cc15e4c027b4b6e6e2c1a97f181e331231d391df306f5b2e365d78203a74137fb7f9a92161

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks