Overview

overview

10

Static

static

10

068990133b...01.exe

windows7_x64

10

068990133b...01.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    068990133b37649cfd4b6ee2bf8235a1a7a638e180f2087cdc806415dc866801

  • Size

    80KB

  • Sample

    220212-mp91nsbcf5

  • MD5

    51b22f6a1aad9dff22dea50e74d0d3da

  • SHA1

    9b3006d6ca2fea91832abe9c3de319bf57a7e890

  • SHA256

    068990133b37649cfd4b6ee2bf8235a1a7a638e180f2087cdc806415dc866801

  • SHA512

    d1e10d3a64a3addc45d05d5dc50ea7eac291cbe4829aaef6d3cad1a58afac95cb972a968f44190ef031abac6ddec99cbaad9d5617bbd4417a86d4cdb6b5eb344

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      068990133b37649cfd4b6ee2bf8235a1a7a638e180f2087cdc806415dc866801

    • Size

      80KB

    • MD5

      51b22f6a1aad9dff22dea50e74d0d3da

    • SHA1

      9b3006d6ca2fea91832abe9c3de319bf57a7e890

    • SHA256

      068990133b37649cfd4b6ee2bf8235a1a7a638e180f2087cdc806415dc866801

    • SHA512

      d1e10d3a64a3addc45d05d5dc50ea7eac291cbe4829aaef6d3cad1a58afac95cb972a968f44190ef031abac6ddec99cbaad9d5617bbd4417a86d4cdb6b5eb344

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks