Overview

overview

10

Static

static

10

064be8fac1...ed.exe

windows7_x64

10

064be8fac1...ed.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    064be8fac1b4858a59fb9c811811b6ae7829f68d01eb7dc3a5659bcdfebb02ed

  • Size

    150KB

  • Sample

    220212-mr9spabch3

  • MD5

    6e0db815101b87e4c746063a8e14dd7d

  • SHA1

    d66e1a4c3a496b5b37f0cc0278fcc4427797fe30

  • SHA256

    064be8fac1b4858a59fb9c811811b6ae7829f68d01eb7dc3a5659bcdfebb02ed

  • SHA512

    b520c0454d44c985c2c31c207125717a8ae2ee8f109329de95ba27c2d7f9e4e105dfe1e25bd8d1e618245d15ae6ccf0d9e2bc95558acafc776ad3ed64744152d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      064be8fac1b4858a59fb9c811811b6ae7829f68d01eb7dc3a5659bcdfebb02ed

    • Size

      150KB

    • MD5

      6e0db815101b87e4c746063a8e14dd7d

    • SHA1

      d66e1a4c3a496b5b37f0cc0278fcc4427797fe30

    • SHA256

      064be8fac1b4858a59fb9c811811b6ae7829f68d01eb7dc3a5659bcdfebb02ed

    • SHA512

      b520c0454d44c985c2c31c207125717a8ae2ee8f109329de95ba27c2d7f9e4e105dfe1e25bd8d1e618245d15ae6ccf0d9e2bc95558acafc776ad3ed64744152d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks