Overview

overview

10

Static

static

10

06246e3624...3d.exe

windows7_x64

10

06246e3624...3d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06246e362459a5a17cd0d8f00bfc952702b1b94986081f890fb68eb12cb5783d

  • Size

    184KB

  • Sample

    220212-mve3gsbdb6

  • MD5

    d2279cb4a64ec2c544783e95dcf33c9e

  • SHA1

    1b2efbace14cf327bd27a4980647fcb9a6e02255

  • SHA256

    06246e362459a5a17cd0d8f00bfc952702b1b94986081f890fb68eb12cb5783d

  • SHA512

    20e98e2447df127252f9856789b2d2fa6eab6c3bb2ee240a825f9312490f04fd75dc37b461fe718f5ecc3461838a6c147fae8469802f2ed85a93c6f1f2ef1ba0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      06246e362459a5a17cd0d8f00bfc952702b1b94986081f890fb68eb12cb5783d

    • Size

      184KB

    • MD5

      d2279cb4a64ec2c544783e95dcf33c9e

    • SHA1

      1b2efbace14cf327bd27a4980647fcb9a6e02255

    • SHA256

      06246e362459a5a17cd0d8f00bfc952702b1b94986081f890fb68eb12cb5783d

    • SHA512

      20e98e2447df127252f9856789b2d2fa6eab6c3bb2ee240a825f9312490f04fd75dc37b461fe718f5ecc3461838a6c147fae8469802f2ed85a93c6f1f2ef1ba0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks