Overview

overview

10

Static

static

10

078d69c5f0...a6.exe

windows7_x64

10

078d69c5f0...a6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    078d69c5f07e2d53cbf501e1fa7f125184b15ccaaee3e453ea3ba51496e52ea6

  • Size

    101KB

  • Sample

    220212-mddhbscgcj

  • MD5

    bb43fe37869ddcbf937d2b7ee2a945d7

  • SHA1

    921240a16e15dc94a840796a8b6ff1e4e4575184

  • SHA256

    078d69c5f07e2d53cbf501e1fa7f125184b15ccaaee3e453ea3ba51496e52ea6

  • SHA512

    6d6a3c616cf2669d9d585bdda1d3b4a076c0d2722adb12a512a325479708c3bdfe01f0b1b490d4531b7d253b1eb955c8ad1dc4a0b563bd0432bcbb201454b97e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      078d69c5f07e2d53cbf501e1fa7f125184b15ccaaee3e453ea3ba51496e52ea6

    • Size

      101KB

    • MD5

      bb43fe37869ddcbf937d2b7ee2a945d7

    • SHA1

      921240a16e15dc94a840796a8b6ff1e4e4575184

    • SHA256

      078d69c5f07e2d53cbf501e1fa7f125184b15ccaaee3e453ea3ba51496e52ea6

    • SHA512

      6d6a3c616cf2669d9d585bdda1d3b4a076c0d2722adb12a512a325479708c3bdfe01f0b1b490d4531b7d253b1eb955c8ad1dc4a0b563bd0432bcbb201454b97e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks