Overview

overview

10

Static

static

10

06c843d05d...13.exe

windows7_x64

10

06c843d05d...13.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06c843d05d6e2b06a1fc859002f35fd840215d44421ad67e0de2206d5ebe2c13

  • Size

    99KB

  • Sample

    220212-mme3hsbcc7

  • MD5

    ba109fe7b1a6c7b90fc5eda7b0617ecf

  • SHA1

    399d7349b9bd43ef85c6daf6fe06de2da54b7155

  • SHA256

    06c843d05d6e2b06a1fc859002f35fd840215d44421ad67e0de2206d5ebe2c13

  • SHA512

    71f0d7a93d797a9fe887046c5938a9ac56f72fdd9f19333855ca613eb177dc1c0b4e4c37cd7f2e9aa8475ccca9eee436c662deed3f67e7234abb26cf6bdce826

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06c843d05d6e2b06a1fc859002f35fd840215d44421ad67e0de2206d5ebe2c13

    • Size

      99KB

    • MD5

      ba109fe7b1a6c7b90fc5eda7b0617ecf

    • SHA1

      399d7349b9bd43ef85c6daf6fe06de2da54b7155

    • SHA256

      06c843d05d6e2b06a1fc859002f35fd840215d44421ad67e0de2206d5ebe2c13

    • SHA512

      71f0d7a93d797a9fe887046c5938a9ac56f72fdd9f19333855ca613eb177dc1c0b4e4c37cd7f2e9aa8475ccca9eee436c662deed3f67e7234abb26cf6bdce826

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks