Overview

overview

10

Static

static

06e3f790ed...5b.exe

windows7_x64

10

06e3f790ed...5b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06e3f790ed965f747ad561cdcdb0ccefd49b8ecd5d9ec75e209b09b0a437425b

  • Size

    58KB

  • Sample

    220212-mkr93abca8

  • MD5

    f89448dc550d7930c71a55b1616e9aae

  • SHA1

    afbdcbdd8fe1989f07f4836c501b0cb2e97411cc

  • SHA256

    06e3f790ed965f747ad561cdcdb0ccefd49b8ecd5d9ec75e209b09b0a437425b

  • SHA512

    bdd140cb434848b2d8d3e450db4fbe4e7919d782d161f7a9f2aa377ea5982163ebc2ed54b54fad0fd7d404f386050658541f46e1a70df949267a5adbd5b0c6ac

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06e3f790ed965f747ad561cdcdb0ccefd49b8ecd5d9ec75e209b09b0a437425b

    • Size

      58KB

    • MD5

      f89448dc550d7930c71a55b1616e9aae

    • SHA1

      afbdcbdd8fe1989f07f4836c501b0cb2e97411cc

    • SHA256

      06e3f790ed965f747ad561cdcdb0ccefd49b8ecd5d9ec75e209b09b0a437425b

    • SHA512

      bdd140cb434848b2d8d3e450db4fbe4e7919d782d161f7a9f2aa377ea5982163ebc2ed54b54fad0fd7d404f386050658541f46e1a70df949267a5adbd5b0c6ac

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks