Overview

overview

10

Static

static

10

06c235eeb8...ea.exe

windows7_x64

10

06c235eeb8...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06c235eeb81e0006e54e98b47170704292c7a878831d1f0b43e83150eb00f3ea

  • Size

    89KB

  • Sample

    220212-mm1zzsbcd4

  • MD5

    86fffd0dcd1dc6e61d428a81a3796a91

  • SHA1

    a688630ae780f5383e1ba271d9a0bd0a27165d42

  • SHA256

    06c235eeb81e0006e54e98b47170704292c7a878831d1f0b43e83150eb00f3ea

  • SHA512

    aeed83e93c4606b5c7717187e16e0b26a8710cac9ac9995a8c83062e1cb0d5e15eb0faa1ffd1cb2cd772cb31e2e492363857149e5a6f2db3555b7d519e2a6a4b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06c235eeb81e0006e54e98b47170704292c7a878831d1f0b43e83150eb00f3ea

    • Size

      89KB

    • MD5

      86fffd0dcd1dc6e61d428a81a3796a91

    • SHA1

      a688630ae780f5383e1ba271d9a0bd0a27165d42

    • SHA256

      06c235eeb81e0006e54e98b47170704292c7a878831d1f0b43e83150eb00f3ea

    • SHA512

      aeed83e93c4606b5c7717187e16e0b26a8710cac9ac9995a8c83062e1cb0d5e15eb0faa1ffd1cb2cd772cb31e2e492363857149e5a6f2db3555b7d519e2a6a4b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks