Overview

overview

10

Static

static

064b5a02f0...f0.exe

windows7_x64

10

064b5a02f0...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    064b5a02f0f87e44766e115d50e77c69dd889ffe122a568fab48ec76dbb5eef0

  • Size

    35KB

  • Sample

    220212-msbmaadabq

  • MD5

    ca3eb031f52fdb3ee35a0b2ac18d69bd

  • SHA1

    8807a0f624d4d9340c57e71686972ddeceeb4ff6

  • SHA256

    064b5a02f0f87e44766e115d50e77c69dd889ffe122a568fab48ec76dbb5eef0

  • SHA512

    e38df41b2d4ed94776e76c6ea722d5142aa1f7c67c33ecea75d6ddddee7eceafd648827dc677736e21a06892267900e3c6d9d910134931027cce443f6764fa6e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      064b5a02f0f87e44766e115d50e77c69dd889ffe122a568fab48ec76dbb5eef0

    • Size

      35KB

    • MD5

      ca3eb031f52fdb3ee35a0b2ac18d69bd

    • SHA1

      8807a0f624d4d9340c57e71686972ddeceeb4ff6

    • SHA256

      064b5a02f0f87e44766e115d50e77c69dd889ffe122a568fab48ec76dbb5eef0

    • SHA512

      e38df41b2d4ed94776e76c6ea722d5142aa1f7c67c33ecea75d6ddddee7eceafd648827dc677736e21a06892267900e3c6d9d910134931027cce443f6764fa6e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks