Overview

overview

10

Static

static

10

0731c464d4...76.exe

windows7_x64

10

0731c464d4...76.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0731c464d4ab5bc1b1a9a54f3448255a44a024ad3c868928ebd535ecdce92576

  • Size

    101KB

  • Sample

    220212-mgp1jacgfk

  • MD5

    cce8790531be363d3e9d5d157c930cc9

  • SHA1

    026a7184f358a33e00bf1b984e489e9bb6b4a619

  • SHA256

    0731c464d4ab5bc1b1a9a54f3448255a44a024ad3c868928ebd535ecdce92576

  • SHA512

    e9c8fb13b906bf8e62c270d702369f5b83e16afd978559840b3528a9299be8e512ae354eeb838356c9ae0344f7464ede3559018bf60da5c87a162caaa0d889de

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0731c464d4ab5bc1b1a9a54f3448255a44a024ad3c868928ebd535ecdce92576

    • Size

      101KB

    • MD5

      cce8790531be363d3e9d5d157c930cc9

    • SHA1

      026a7184f358a33e00bf1b984e489e9bb6b4a619

    • SHA256

      0731c464d4ab5bc1b1a9a54f3448255a44a024ad3c868928ebd535ecdce92576

    • SHA512

      e9c8fb13b906bf8e62c270d702369f5b83e16afd978559840b3528a9299be8e512ae354eeb838356c9ae0344f7464ede3559018bf60da5c87a162caaa0d889de

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks