Overview

overview

10

Static

static

10

06c4ac1772...63.exe

windows7_x64

10

06c4ac1772...63.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06c4ac177231dbd61db53752f3149eb522346bbedddc7c466aa0405988b46863

  • Size

    100KB

  • Sample

    220212-mmplyscher

  • MD5

    225591579edd905e956b28a27bb1ab55

  • SHA1

    fb5454a8e238ea5837c4ce26959577f39550c861

  • SHA256

    06c4ac177231dbd61db53752f3149eb522346bbedddc7c466aa0405988b46863

  • SHA512

    b1323060ed953fa5939d82fad59b5eada1b2b7b6b31b45a8afe1422f89bc006b879c986ce1fca51310dd9956c60bd2092636216653e4d55dc182c9f64f187043

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06c4ac177231dbd61db53752f3149eb522346bbedddc7c466aa0405988b46863

    • Size

      100KB

    • MD5

      225591579edd905e956b28a27bb1ab55

    • SHA1

      fb5454a8e238ea5837c4ce26959577f39550c861

    • SHA256

      06c4ac177231dbd61db53752f3149eb522346bbedddc7c466aa0405988b46863

    • SHA512

      b1323060ed953fa5939d82fad59b5eada1b2b7b6b31b45a8afe1422f89bc006b879c986ce1fca51310dd9956c60bd2092636216653e4d55dc182c9f64f187043

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks