Overview

overview

10

Static

static

072be36b96...8b.exe

windows7_x64

10

072be36b96...8b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    072be36b96f77f310525835b8c370e3c40a3d271867feb7358efa2e82f6a228b

  • Size

    58KB

  • Sample

    220212-mg6y2scgfp

  • MD5

    2e312ef28b7663608e2ae5c9fd97d2cb

  • SHA1

    40d9951c12f2b5558dd76ce575acaff5b4bf8e70

  • SHA256

    072be36b96f77f310525835b8c370e3c40a3d271867feb7358efa2e82f6a228b

  • SHA512

    2e5c6030d9f11c679f4c1e80ccf12696b6352cf13e90d9dd24923cdcdd7cc764160a6619cef41c479ead174844ef1d910b8af17b5371df77980f68fee6e33154

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      072be36b96f77f310525835b8c370e3c40a3d271867feb7358efa2e82f6a228b

    • Size

      58KB

    • MD5

      2e312ef28b7663608e2ae5c9fd97d2cb

    • SHA1

      40d9951c12f2b5558dd76ce575acaff5b4bf8e70

    • SHA256

      072be36b96f77f310525835b8c370e3c40a3d271867feb7358efa2e82f6a228b

    • SHA512

      2e5c6030d9f11c679f4c1e80ccf12696b6352cf13e90d9dd24923cdcdd7cc764160a6619cef41c479ead174844ef1d910b8af17b5371df77980f68fee6e33154

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks