Overview

overview

10

Static

static

06b13702b7...98.exe

windows7_x64

10

06b13702b7...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06b13702b7068c35ba5bd72b0f6bc109726c340a12bfeb0c48b9b74c560ac598

  • Size

    36KB

  • Sample

    220212-mny7sabce4

  • MD5

    b20b8a817f01f6d1e46bbae0c3140320

  • SHA1

    a545880b56cb41fac4b12ded9c468bd52161edba

  • SHA256

    06b13702b7068c35ba5bd72b0f6bc109726c340a12bfeb0c48b9b74c560ac598

  • SHA512

    9d5f39a53e3052e74607751548380318ea8f724a5f883f2fe6529c7d8e88ff757bf9e5f53791d868bbc6992d2502fc2663dbfc6fa71ff2138ffcc98ac1d92959

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06b13702b7068c35ba5bd72b0f6bc109726c340a12bfeb0c48b9b74c560ac598

    • Size

      36KB

    • MD5

      b20b8a817f01f6d1e46bbae0c3140320

    • SHA1

      a545880b56cb41fac4b12ded9c468bd52161edba

    • SHA256

      06b13702b7068c35ba5bd72b0f6bc109726c340a12bfeb0c48b9b74c560ac598

    • SHA512

      9d5f39a53e3052e74607751548380318ea8f724a5f883f2fe6529c7d8e88ff757bf9e5f53791d868bbc6992d2502fc2663dbfc6fa71ff2138ffcc98ac1d92959

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks