Overview

overview

10

Static

static

10

072ed6cc45...c5.exe

windows7_x64

10

072ed6cc45...c5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    072ed6cc455a675eddb3832d6492f7fb251fe5aee1be02b47cc213bdeb8e3dc5

  • Size

    100KB

  • Sample

    220212-mgxqdabbe7

  • MD5

    98bb3db7c7dfe2097f88a778ca65eea7

  • SHA1

    b8ad9ca9c3f5a38d2f536de5e05e9d808780618d

  • SHA256

    072ed6cc455a675eddb3832d6492f7fb251fe5aee1be02b47cc213bdeb8e3dc5

  • SHA512

    6aa9b1563ad61415097bd32e1b38f46338d575aa1641768496f5c146b3f010010ed2f465ba40c33a7e63d6cf3bb6b7eeedbadefb80de78c0a322fbe00b271518

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      072ed6cc455a675eddb3832d6492f7fb251fe5aee1be02b47cc213bdeb8e3dc5

    • Size

      100KB

    • MD5

      98bb3db7c7dfe2097f88a778ca65eea7

    • SHA1

      b8ad9ca9c3f5a38d2f536de5e05e9d808780618d

    • SHA256

      072ed6cc455a675eddb3832d6492f7fb251fe5aee1be02b47cc213bdeb8e3dc5

    • SHA512

      6aa9b1563ad61415097bd32e1b38f46338d575aa1641768496f5c146b3f010010ed2f465ba40c33a7e63d6cf3bb6b7eeedbadefb80de78c0a322fbe00b271518

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks