Overview

overview

10

Static

static

0736322089...02.exe

windows7_x64

10

0736322089...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0736322089c98bb0763f30cdddd5ef5eae222c958ab8b463f3fed49fbc4e3e02

  • Size

    58KB

  • Sample

    220212-mgf3mabbe2

  • MD5

    8c1c888309730707fd20966a625599c0

  • SHA1

    2cdc419dfbceb33a7d01171e584aed04ba79aa44

  • SHA256

    0736322089c98bb0763f30cdddd5ef5eae222c958ab8b463f3fed49fbc4e3e02

  • SHA512

    49558756ce9d0759fd82ad443d81e5fb7fa63315ed3b1bcfdfae82531bc6c7bbda9819adb4d0d21d6f6c78d6f86f604b05bc295317b8a05e63f82fd6ccd6ef71

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0736322089c98bb0763f30cdddd5ef5eae222c958ab8b463f3fed49fbc4e3e02

    • Size

      58KB

    • MD5

      8c1c888309730707fd20966a625599c0

    • SHA1

      2cdc419dfbceb33a7d01171e584aed04ba79aa44

    • SHA256

      0736322089c98bb0763f30cdddd5ef5eae222c958ab8b463f3fed49fbc4e3e02

    • SHA512

      49558756ce9d0759fd82ad443d81e5fb7fa63315ed3b1bcfdfae82531bc6c7bbda9819adb4d0d21d6f6c78d6f86f604b05bc295317b8a05e63f82fd6ccd6ef71

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks