Overview

overview

10

Static

static

06c0717754...60.exe

windows7_x64

10

06c0717754...60.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06c071775430c405321033d7aa87389054df7ab6d4c33e760541254ea4d6e660

  • Size

    58KB

  • Sample

    220212-mm3tksbcd5

  • MD5

    f5304bbb3e5b6f947ecb1c1bb34a6f2f

  • SHA1

    96e8234b77762482f17842475b266ab7b367fb8a

  • SHA256

    06c071775430c405321033d7aa87389054df7ab6d4c33e760541254ea4d6e660

  • SHA512

    f3e9680b2624927cfce258fd45daf143827ffa1bbef661021ec5690736bb8dd9333e689e5f4b7da5e30e958c93e31532040633e502e275bb7ad5163091b65897

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06c071775430c405321033d7aa87389054df7ab6d4c33e760541254ea4d6e660

    • Size

      58KB

    • MD5

      f5304bbb3e5b6f947ecb1c1bb34a6f2f

    • SHA1

      96e8234b77762482f17842475b266ab7b367fb8a

    • SHA256

      06c071775430c405321033d7aa87389054df7ab6d4c33e760541254ea4d6e660

    • SHA512

      f3e9680b2624927cfce258fd45daf143827ffa1bbef661021ec5690736bb8dd9333e689e5f4b7da5e30e958c93e31532040633e502e275bb7ad5163091b65897

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks