Overview

overview

10

Static

static

06ca6b5bd8...e4.exe

windows7_x64

10

06ca6b5bd8...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06ca6b5bd8860d3a258579c4dcdc49f6342da079b7932801de584000bf077be4

  • Size

    60KB

  • Sample

    220212-ml89zachen

  • MD5

    310745571d2d913e808483123972acea

  • SHA1

    712894fb1797957fad8f8c5543e66e6ce5ac90a6

  • SHA256

    06ca6b5bd8860d3a258579c4dcdc49f6342da079b7932801de584000bf077be4

  • SHA512

    d9cf1256236e4aee9dd63d97d23f6244931e0c4d05a1f762c13c40a74b6a819f163a2bdab2e224f6f37d95a268ab634a061b39ba5525f6dc1617359682bf5e0d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06ca6b5bd8860d3a258579c4dcdc49f6342da079b7932801de584000bf077be4

    • Size

      60KB

    • MD5

      310745571d2d913e808483123972acea

    • SHA1

      712894fb1797957fad8f8c5543e66e6ce5ac90a6

    • SHA256

      06ca6b5bd8860d3a258579c4dcdc49f6342da079b7932801de584000bf077be4

    • SHA512

      d9cf1256236e4aee9dd63d97d23f6244931e0c4d05a1f762c13c40a74b6a819f163a2bdab2e224f6f37d95a268ab634a061b39ba5525f6dc1617359682bf5e0d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks