Overview

overview

10

Static

static

06be3e0ad7...06.exe

windows7_x64

10

06be3e0ad7...06.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06be3e0ad78f6334cf97518d61a0e102d61ad764f7fa0ca54a572945b0810c06

  • Size

    36KB

  • Sample

    220212-mm9xwschfk

  • MD5

    298b4aa1c35038da0f9bb828840f54a9

  • SHA1

    56ec1c11bd2bb1a8b27357961228a0871385e048

  • SHA256

    06be3e0ad78f6334cf97518d61a0e102d61ad764f7fa0ca54a572945b0810c06

  • SHA512

    ba38491f3cb3a3d291cc06ecac821e0b4652524a2856360e67710f7696d1b3cefbb006cee30b64e324d0c4f65e6bfbcba8a797f6b57d91f79ef19ddc42ebadfe

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06be3e0ad78f6334cf97518d61a0e102d61ad764f7fa0ca54a572945b0810c06

    • Size

      36KB

    • MD5

      298b4aa1c35038da0f9bb828840f54a9

    • SHA1

      56ec1c11bd2bb1a8b27357961228a0871385e048

    • SHA256

      06be3e0ad78f6334cf97518d61a0e102d61ad764f7fa0ca54a572945b0810c06

    • SHA512

      ba38491f3cb3a3d291cc06ecac821e0b4652524a2856360e67710f7696d1b3cefbb006cee30b64e324d0c4f65e6bfbcba8a797f6b57d91f79ef19ddc42ebadfe

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks