Overview

overview

10

Static

static

10

065642eea8...60.exe

windows7_x64

10

065642eea8...60.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    065642eea89a547b1db1fdd6e6e6eb89984523f46b7824c4a07cfbaa7ba93b60

  • Size

    99KB

  • Sample

    220212-mryqesdabm

  • MD5

    730ba0ab7baf63252432bfa78c883c16

  • SHA1

    66f6626a3c89ae6cdda42b4d54dcdb1790e7f259

  • SHA256

    065642eea89a547b1db1fdd6e6e6eb89984523f46b7824c4a07cfbaa7ba93b60

  • SHA512

    c10eca1889939d722a15892ab3d6af467fd14a1264e6c4278c9b4fcaa66ce628757017a7d23a8c961b4dfe120534b6a679dcf4ad734c2c299d36d2e4c78a6bd0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      065642eea89a547b1db1fdd6e6e6eb89984523f46b7824c4a07cfbaa7ba93b60

    • Size

      99KB

    • MD5

      730ba0ab7baf63252432bfa78c883c16

    • SHA1

      66f6626a3c89ae6cdda42b4d54dcdb1790e7f259

    • SHA256

      065642eea89a547b1db1fdd6e6e6eb89984523f46b7824c4a07cfbaa7ba93b60

    • SHA512

      c10eca1889939d722a15892ab3d6af467fd14a1264e6c4278c9b4fcaa66ce628757017a7d23a8c961b4dfe120534b6a679dcf4ad734c2c299d36d2e4c78a6bd0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks