Overview

overview

10

Static

static

06fae66478...07.exe

windows7_x64

10

06fae66478...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06fae664785210eff176da32e24bc6613103617162eb9962372e682042be7107

  • Size

    58KB

  • Sample

    220212-mj3dmsbbh7

  • MD5

    3bc95982d12179be042ebf1f6a6e3f24

  • SHA1

    03ba166895c449b9db563c9857cdb2c1024e5fc3

  • SHA256

    06fae664785210eff176da32e24bc6613103617162eb9962372e682042be7107

  • SHA512

    d29747a1ed74ca0a73f075e81c85fa31c8c4ee9a7595e34d58bad6201b53472035985c72a0ac30630af8599f8533f4daabf8ab69462df94aa5c2be98f202abc4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06fae664785210eff176da32e24bc6613103617162eb9962372e682042be7107

    • Size

      58KB

    • MD5

      3bc95982d12179be042ebf1f6a6e3f24

    • SHA1

      03ba166895c449b9db563c9857cdb2c1024e5fc3

    • SHA256

      06fae664785210eff176da32e24bc6613103617162eb9962372e682042be7107

    • SHA512

      d29747a1ed74ca0a73f075e81c85fa31c8c4ee9a7595e34d58bad6201b53472035985c72a0ac30630af8599f8533f4daabf8ab69462df94aa5c2be98f202abc4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks