Overview

overview

10

Static

static

06bd1dc338...78.exe

windows7_x64

10

06bd1dc338...78.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06bd1dc33846dc49a26d4ffd83c0750c6927d1756682073a86ae49f4ab0aa278

  • Size

    60KB

  • Sample

    220212-mndwvachfl

  • MD5

    62445e96c7cc3c8a7d53f96de17968bf

  • SHA1

    a912e166f72047c2a50a600a2535080f351dfa4f

  • SHA256

    06bd1dc33846dc49a26d4ffd83c0750c6927d1756682073a86ae49f4ab0aa278

  • SHA512

    59683b8d725cc3e5cb56e6083621fb80aca05cd1a67a9c8162217233ff2874df941f3407c74973ced8af453dda216183e5108f9fbf488fe4846dab634937c840

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06bd1dc33846dc49a26d4ffd83c0750c6927d1756682073a86ae49f4ab0aa278

    • Size

      60KB

    • MD5

      62445e96c7cc3c8a7d53f96de17968bf

    • SHA1

      a912e166f72047c2a50a600a2535080f351dfa4f

    • SHA256

      06bd1dc33846dc49a26d4ffd83c0750c6927d1756682073a86ae49f4ab0aa278

    • SHA512

      59683b8d725cc3e5cb56e6083621fb80aca05cd1a67a9c8162217233ff2874df941f3407c74973ced8af453dda216183e5108f9fbf488fe4846dab634937c840

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks