Overview

overview

10

Static

static

0637ce07ef...52.exe

windows7_x64

10

0637ce07ef...52.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0637ce07eff87ba42108fcfb2f561ba03fe77e85b0f641d3e62d87b960a19252

  • Size

    58KB

  • Sample

    220212-mtd4ssdacr

  • MD5

    7fdcb9d5cc8c8c8a92ab64f04804b668

  • SHA1

    d3361549e4933fd61e06ced2e843c8efd982fd00

  • SHA256

    0637ce07eff87ba42108fcfb2f561ba03fe77e85b0f641d3e62d87b960a19252

  • SHA512

    ad8febf845d1a06a71cf129415a637a55d5798e19df7486e70e65be1a7aa29d9b59bc0548b67d5a8939da1084bce2f02f046cae1194cb406a7fd9ddb4c379f7e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0637ce07eff87ba42108fcfb2f561ba03fe77e85b0f641d3e62d87b960a19252

    • Size

      58KB

    • MD5

      7fdcb9d5cc8c8c8a92ab64f04804b668

    • SHA1

      d3361549e4933fd61e06ced2e843c8efd982fd00

    • SHA256

      0637ce07eff87ba42108fcfb2f561ba03fe77e85b0f641d3e62d87b960a19252

    • SHA512

      ad8febf845d1a06a71cf129415a637a55d5798e19df7486e70e65be1a7aa29d9b59bc0548b67d5a8939da1084bce2f02f046cae1194cb406a7fd9ddb4c379f7e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks