Overview

overview

10

Static

static

10

0753a33352...7b.exe

windows7_x64

10

0753a33352...7b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0753a3335292f5c40e7ab0c7e007355c77043c446ef3933f0f0647d368e00f7b

  • Size

    176KB

  • Sample

    220212-mfpy5sbbc9

  • MD5

    f37c83298bab4609f0d62ae541e53486

  • SHA1

    b52a499ddc641ef26461c273bc6fd0748a4d8ffa

  • SHA256

    0753a3335292f5c40e7ab0c7e007355c77043c446ef3933f0f0647d368e00f7b

  • SHA512

    2132faf38f0942b57f0caed977e881cb6ae1afb6be4549676e070a0a4a8dbdf91b87ccd518829c9d2daedd81087410554b594f94b3dd16b6e8a4264c2b46c090

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0753a3335292f5c40e7ab0c7e007355c77043c446ef3933f0f0647d368e00f7b

    • Size

      176KB

    • MD5

      f37c83298bab4609f0d62ae541e53486

    • SHA1

      b52a499ddc641ef26461c273bc6fd0748a4d8ffa

    • SHA256

      0753a3335292f5c40e7ab0c7e007355c77043c446ef3933f0f0647d368e00f7b

    • SHA512

      2132faf38f0942b57f0caed977e881cb6ae1afb6be4549676e070a0a4a8dbdf91b87ccd518829c9d2daedd81087410554b594f94b3dd16b6e8a4264c2b46c090

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks