Overview

overview

10

Static

static

10

079bfdae7f...ed.exe

windows7_x64

10

079bfdae7f...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079bfdae7fa3c8ed0d21eaec2d16e0f20c8fdc52d7ccff0e259fb67ee9bf10ed

  • Size

    99KB

  • Sample

    220212-mcl33sbah8

  • MD5

    869b5dd44aefb64b0bfef988332fc2df

  • SHA1

    f40da8708e8311b4a525993964659a79149aac15

  • SHA256

    079bfdae7fa3c8ed0d21eaec2d16e0f20c8fdc52d7ccff0e259fb67ee9bf10ed

  • SHA512

    81a9ea4ecce5a01358dcdac8b1850ab5c9a7cfe45137a786c9a57edc98bcea518faa6686e908e7bec658d658d8fea73466a82bd3bcddd76f028f556c58861e64

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      079bfdae7fa3c8ed0d21eaec2d16e0f20c8fdc52d7ccff0e259fb67ee9bf10ed

    • Size

      99KB

    • MD5

      869b5dd44aefb64b0bfef988332fc2df

    • SHA1

      f40da8708e8311b4a525993964659a79149aac15

    • SHA256

      079bfdae7fa3c8ed0d21eaec2d16e0f20c8fdc52d7ccff0e259fb67ee9bf10ed

    • SHA512

      81a9ea4ecce5a01358dcdac8b1850ab5c9a7cfe45137a786c9a57edc98bcea518faa6686e908e7bec658d658d8fea73466a82bd3bcddd76f028f556c58861e64

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks