Overview

overview

10

Static

static

065fcd4226...8d.exe

windows7_x64

10

065fcd4226...8d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    065fcd4226c336a720a1818aa97b8bd1dcbdb58f4b5ca85b2d32a3b05c32798d

  • Size

    36KB

  • Sample

    220212-mrn6zsbcg7

  • MD5

    a8b36f614d5ad0f929c20101f8314c67

  • SHA1

    af33d34be355a0f19d38b6913c366d5954282770

  • SHA256

    065fcd4226c336a720a1818aa97b8bd1dcbdb58f4b5ca85b2d32a3b05c32798d

  • SHA512

    fdfff3b52c87601a4698b0e0486d8129bb819e9c8493fd92378ca161f13961a7accb694530aefe27bab989b71aa6b828848186c871195f6aa1aa74e34a75a326

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      065fcd4226c336a720a1818aa97b8bd1dcbdb58f4b5ca85b2d32a3b05c32798d

    • Size

      36KB

    • MD5

      a8b36f614d5ad0f929c20101f8314c67

    • SHA1

      af33d34be355a0f19d38b6913c366d5954282770

    • SHA256

      065fcd4226c336a720a1818aa97b8bd1dcbdb58f4b5ca85b2d32a3b05c32798d

    • SHA512

      fdfff3b52c87601a4698b0e0486d8129bb819e9c8493fd92378ca161f13961a7accb694530aefe27bab989b71aa6b828848186c871195f6aa1aa74e34a75a326

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks