Overview

overview

10

Static

static

10

079c611d7c...9e.exe

windows7_x64

10

079c611d7c...9e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079c611d7ce060680f9b6f2890bfb7d6d3d85b164d0e1db603590231f3cea09e

  • Size

    216KB

  • Sample

    220212-mcj9gsbah7

  • MD5

    772dcd2087a13eed518892884fde08b2

  • SHA1

    42e066c4b4900367cfba28c0b6c8d31fe4d50f04

  • SHA256

    079c611d7ce060680f9b6f2890bfb7d6d3d85b164d0e1db603590231f3cea09e

  • SHA512

    678b96f492320d082f351e860760352aa59641e6aeb64122f88f42cd64365e21405a0b2edb31ccddd4093e305e062ed81080d8c77ac51cd02060cd8ac0105f69

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      079c611d7ce060680f9b6f2890bfb7d6d3d85b164d0e1db603590231f3cea09e

    • Size

      216KB

    • MD5

      772dcd2087a13eed518892884fde08b2

    • SHA1

      42e066c4b4900367cfba28c0b6c8d31fe4d50f04

    • SHA256

      079c611d7ce060680f9b6f2890bfb7d6d3d85b164d0e1db603590231f3cea09e

    • SHA512

      678b96f492320d082f351e860760352aa59641e6aeb64122f88f42cd64365e21405a0b2edb31ccddd4093e305e062ed81080d8c77ac51cd02060cd8ac0105f69

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks