Overview

overview

10

Static

static

10

0675f2fb48...68.exe

windows7_x64

10

0675f2fb48...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0675f2fb4833ff4959d0be9956e48769391ebcfdc2a796ba354def1a071bad68

  • Size

    101KB

  • Sample

    220212-mqw57sbcf8

  • MD5

    9962a946a80ee762246ce7bfed1420df

  • SHA1

    8392cb18eb5a67c6963f90c1cc8687b7a5309f54

  • SHA256

    0675f2fb4833ff4959d0be9956e48769391ebcfdc2a796ba354def1a071bad68

  • SHA512

    9beb8b59d13f3c4dfbd71584ce8a4d1755a32a050ff50fcf1396475123d94774c5515386d17d4fedca22d662076f2d2d37fddf5f821c70823f675adbd6d7759f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0675f2fb4833ff4959d0be9956e48769391ebcfdc2a796ba354def1a071bad68

    • Size

      101KB

    • MD5

      9962a946a80ee762246ce7bfed1420df

    • SHA1

      8392cb18eb5a67c6963f90c1cc8687b7a5309f54

    • SHA256

      0675f2fb4833ff4959d0be9956e48769391ebcfdc2a796ba354def1a071bad68

    • SHA512

      9beb8b59d13f3c4dfbd71584ce8a4d1755a32a050ff50fcf1396475123d94774c5515386d17d4fedca22d662076f2d2d37fddf5f821c70823f675adbd6d7759f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks