Overview

overview

10

Static

static

10

0735f6ade0...6f.exe

windows7_x64

10

0735f6ade0...6f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0735f6ade0963aa1ccdcc718b462c52a14387e0465d4986e7fb673e32f87a26f

  • Size

    79KB

  • Sample

    220212-mghw8abbe3

  • MD5

    24f601d494ec38f0ada395f99249d05b

  • SHA1

    e93e78d7a15d0d5572c53f41ca6a31b7df4f3ecf

  • SHA256

    0735f6ade0963aa1ccdcc718b462c52a14387e0465d4986e7fb673e32f87a26f

  • SHA512

    a5fedd7fe6377efc5c8078a843cf068f95ac367a725b6d590791f6a9539be1b8562fc74a8a976b3e41e224f7e118fbcb4f7f722088ab7937779a9ace134e3f3b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0735f6ade0963aa1ccdcc718b462c52a14387e0465d4986e7fb673e32f87a26f

    • Size

      79KB

    • MD5

      24f601d494ec38f0ada395f99249d05b

    • SHA1

      e93e78d7a15d0d5572c53f41ca6a31b7df4f3ecf

    • SHA256

      0735f6ade0963aa1ccdcc718b462c52a14387e0465d4986e7fb673e32f87a26f

    • SHA512

      a5fedd7fe6377efc5c8078a843cf068f95ac367a725b6d590791f6a9539be1b8562fc74a8a976b3e41e224f7e118fbcb4f7f722088ab7937779a9ace134e3f3b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks