Overview

overview

10

Static

static

06d8b4de29...77.exe

windows7_x64

10

06d8b4de29...77.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06d8b4de2971df1bfed7e24f4a3357c75f3139c47d3184331b7185c0a6e22d77

  • Size

    35KB

  • Sample

    220212-mlareabcb5

  • MD5

    8b5d6271d7ab70c66d35d09510c0a1cc

  • SHA1

    31d4e3ab00799bb78dff7e2d1613d299add76811

  • SHA256

    06d8b4de2971df1bfed7e24f4a3357c75f3139c47d3184331b7185c0a6e22d77

  • SHA512

    9a2baf8046858361a200c565fb28e05c7551a79c5de44390bfa629deeb3613a316e0de4a20821a38123ff7ece052f16ec883152dcaf4543d867cc45641525fd5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06d8b4de2971df1bfed7e24f4a3357c75f3139c47d3184331b7185c0a6e22d77

    • Size

      35KB

    • MD5

      8b5d6271d7ab70c66d35d09510c0a1cc

    • SHA1

      31d4e3ab00799bb78dff7e2d1613d299add76811

    • SHA256

      06d8b4de2971df1bfed7e24f4a3357c75f3139c47d3184331b7185c0a6e22d77

    • SHA512

      9a2baf8046858361a200c565fb28e05c7551a79c5de44390bfa629deeb3613a316e0de4a20821a38123ff7ece052f16ec883152dcaf4543d867cc45641525fd5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks