Overview

overview

10

Static

static

063668e741...db.exe

windows7_x64

10

063668e741...db.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    063668e741ad440b0e2b1b3ba5107e87ea12c09a38165de5bd22c7a7455a1ddb

  • Size

    58KB

  • Sample

    220212-mtlhwabda7

  • MD5

    ac19a81a8b1aa7d0be6028c4914df6e1

  • SHA1

    89e5101f3f3339d15fe3add08353533a7feb3119

  • SHA256

    063668e741ad440b0e2b1b3ba5107e87ea12c09a38165de5bd22c7a7455a1ddb

  • SHA512

    ba0bdac01896d5d2661982507511fca172d882bf0467cc6ffa832c8cb97f9c2443d7b3b15c69aaf0d654dc556b7d95f3c1546d51e6e0a5ae674c697e59102413

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      063668e741ad440b0e2b1b3ba5107e87ea12c09a38165de5bd22c7a7455a1ddb

    • Size

      58KB

    • MD5

      ac19a81a8b1aa7d0be6028c4914df6e1

    • SHA1

      89e5101f3f3339d15fe3add08353533a7feb3119

    • SHA256

      063668e741ad440b0e2b1b3ba5107e87ea12c09a38165de5bd22c7a7455a1ddb

    • SHA512

      ba0bdac01896d5d2661982507511fca172d882bf0467cc6ffa832c8cb97f9c2443d7b3b15c69aaf0d654dc556b7d95f3c1546d51e6e0a5ae674c697e59102413

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks