Overview

overview

10

Static

static

10

06b0c4340b...45.exe

windows7_x64

10

06b0c4340b...45.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b0c4340beefc65ae38863aaa65e762e5631eb57ab384c7e6c7191db82b6345

  • Size

    108KB

  • Sample

    220212-mn4r9schgl

  • MD5

    cea627589a0385370789953ff8a9d341

  • SHA1

    9f75c2713786b030cb083bfa37af8a7ed7f90457

  • SHA256

    06b0c4340beefc65ae38863aaa65e762e5631eb57ab384c7e6c7191db82b6345

  • SHA512

    f19497b97d4d7c675672daa2ad7d5cd44730936606b93a2ae897d724611aa4464eaaeab14656566fb9f0d27efd60f6810542e72d0b0eb5426d2cd9bcc9cefa83

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06b0c4340beefc65ae38863aaa65e762e5631eb57ab384c7e6c7191db82b6345

    • Size

      108KB

    • MD5

      cea627589a0385370789953ff8a9d341

    • SHA1

      9f75c2713786b030cb083bfa37af8a7ed7f90457

    • SHA256

      06b0c4340beefc65ae38863aaa65e762e5631eb57ab384c7e6c7191db82b6345

    • SHA512

      f19497b97d4d7c675672daa2ad7d5cd44730936606b93a2ae897d724611aa4464eaaeab14656566fb9f0d27efd60f6810542e72d0b0eb5426d2cd9bcc9cefa83

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks