Overview

overview

10

Static

static

0756f3acad...87.exe

windows7_x64

10

0756f3acad...87.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0756f3acad8b7e8b8a4caf52d91a4954fc2a209ae3be4be194235aee7a4e2a87

  • Size

    35KB

  • Sample

    220212-mffqgabbc6

  • MD5

    98fc052b2b1b3ac6dd6b5bda8f3e84c7

  • SHA1

    ef761d5db50ba885e65eb2645327f28624782bd2

  • SHA256

    0756f3acad8b7e8b8a4caf52d91a4954fc2a209ae3be4be194235aee7a4e2a87

  • SHA512

    905d3b74360cac79b5c0bea24ea66b0a50d10cd0311a57b54ec1da07fb8d273febebc58a453dcb4dca96d9fefee9916bb7df0e0912b43aa9ec8eb95c98fea039

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0756f3acad8b7e8b8a4caf52d91a4954fc2a209ae3be4be194235aee7a4e2a87

    • Size

      35KB

    • MD5

      98fc052b2b1b3ac6dd6b5bda8f3e84c7

    • SHA1

      ef761d5db50ba885e65eb2645327f28624782bd2

    • SHA256

      0756f3acad8b7e8b8a4caf52d91a4954fc2a209ae3be4be194235aee7a4e2a87

    • SHA512

      905d3b74360cac79b5c0bea24ea66b0a50d10cd0311a57b54ec1da07fb8d273febebc58a453dcb4dca96d9fefee9916bb7df0e0912b43aa9ec8eb95c98fea039

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks