Overview

overview

10

Static

static

074c9d9de0...08.exe

windows7_x64

10

074c9d9de0...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    074c9d9de05e2ce273cd73372ac8ed6c9ec281f56f1abac90ae703d7cbbdcc08

  • Size

    36KB

  • Sample

    220212-mfw3fsbbd4

  • MD5

    f78453ced7f160192eb2c4b8770035ed

  • SHA1

    180fe2bb0e90f14ac67cba43f6a4e2a5168f7a09

  • SHA256

    074c9d9de05e2ce273cd73372ac8ed6c9ec281f56f1abac90ae703d7cbbdcc08

  • SHA512

    775db782b2dc8ee49b54f582a20d702faa6260db3f65dce9d0170b1ab214a675311cfee3f22812fb10196d9ab83e57856b4445a2e06fed8a8f9dcfb64e0159ee

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      074c9d9de05e2ce273cd73372ac8ed6c9ec281f56f1abac90ae703d7cbbdcc08

    • Size

      36KB

    • MD5

      f78453ced7f160192eb2c4b8770035ed

    • SHA1

      180fe2bb0e90f14ac67cba43f6a4e2a5168f7a09

    • SHA256

      074c9d9de05e2ce273cd73372ac8ed6c9ec281f56f1abac90ae703d7cbbdcc08

    • SHA512

      775db782b2dc8ee49b54f582a20d702faa6260db3f65dce9d0170b1ab214a675311cfee3f22812fb10196d9ab83e57856b4445a2e06fed8a8f9dcfb64e0159ee

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks