Overview

overview

10

Static

static

10

060b1b9579...c5.exe

windows7_x64

10

060b1b9579...c5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    060b1b9579e7e61250d553c09facec1607e58d51123f1ca4c2a6b6aa97db4bc5

  • Size

    216KB

  • Sample

    220212-mwr4fabdc9

  • MD5

    33a7acb8e12de712784463a18d4ee342

  • SHA1

    68d07e04ab0255902eedf8bccf7b4bd2e79a35b5

  • SHA256

    060b1b9579e7e61250d553c09facec1607e58d51123f1ca4c2a6b6aa97db4bc5

  • SHA512

    c3e31d523138daac18d2e1ac7bb80f0b94c4ddd5a2413817f60363cd958df28504c38cdfe601bfec348acfe1fb4e50912794ee4a1b57e63d81e12091ade2d84f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      060b1b9579e7e61250d553c09facec1607e58d51123f1ca4c2a6b6aa97db4bc5

    • Size

      216KB

    • MD5

      33a7acb8e12de712784463a18d4ee342

    • SHA1

      68d07e04ab0255902eedf8bccf7b4bd2e79a35b5

    • SHA256

      060b1b9579e7e61250d553c09facec1607e58d51123f1ca4c2a6b6aa97db4bc5

    • SHA512

      c3e31d523138daac18d2e1ac7bb80f0b94c4ddd5a2413817f60363cd958df28504c38cdfe601bfec348acfe1fb4e50912794ee4a1b57e63d81e12091ade2d84f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks