Overview

overview

10

Static

static

06e2566de3...a6.exe

windows7_x64

10

06e2566de3...a6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06e2566de35015bc090caea875ffdc9f11de8ca593fa5b8422a30a2089ea8ba6

  • Size

    35KB

  • Sample

    220212-mkzn5sbcb3

  • MD5

    402dc588b6efc6dde2452e628ccbf820

  • SHA1

    cdf983d133880e150651ebc710a3bf36b4ae3021

  • SHA256

    06e2566de35015bc090caea875ffdc9f11de8ca593fa5b8422a30a2089ea8ba6

  • SHA512

    0a4542b760c59a8d3d2d57115f495a3fedeeaaa5d5569084246ec3056d556cbb19c38bb5546429e8005697abed14ff8b85789a1a81bcb7e9564d9a00259c765b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06e2566de35015bc090caea875ffdc9f11de8ca593fa5b8422a30a2089ea8ba6

    • Size

      35KB

    • MD5

      402dc588b6efc6dde2452e628ccbf820

    • SHA1

      cdf983d133880e150651ebc710a3bf36b4ae3021

    • SHA256

      06e2566de35015bc090caea875ffdc9f11de8ca593fa5b8422a30a2089ea8ba6

    • SHA512

      0a4542b760c59a8d3d2d57115f495a3fedeeaaa5d5569084246ec3056d556cbb19c38bb5546429e8005697abed14ff8b85789a1a81bcb7e9564d9a00259c765b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks