Overview

overview

10

Static

static

07263389e4...9f.exe

windows7_x64

10

07263389e4...9f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07263389e4fda895a40905656077965990c61c57bfebc3bc4e2ea2f7e6a01f9f

  • Size

    35KB

  • Sample

    220212-mhewyscggj

  • MD5

    f74296a5b8723208d6a3e3256ee19794

  • SHA1

    52dde66729fc4a24e25c0ae5ba85534dd87e9289

  • SHA256

    07263389e4fda895a40905656077965990c61c57bfebc3bc4e2ea2f7e6a01f9f

  • SHA512

    d84152cd0abcf6aeab47732b13cff484e54fabd663619d80d6c093264e3096aae240d329258b3380979fbedb47d3e1b77773022052d02d9a6431f641c2538a36

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      07263389e4fda895a40905656077965990c61c57bfebc3bc4e2ea2f7e6a01f9f

    • Size

      35KB

    • MD5

      f74296a5b8723208d6a3e3256ee19794

    • SHA1

      52dde66729fc4a24e25c0ae5ba85534dd87e9289

    • SHA256

      07263389e4fda895a40905656077965990c61c57bfebc3bc4e2ea2f7e6a01f9f

    • SHA512

      d84152cd0abcf6aeab47732b13cff484e54fabd663619d80d6c093264e3096aae240d329258b3380979fbedb47d3e1b77773022052d02d9a6431f641c2538a36

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks