Overview

overview

10

Static

static

060a70c364...2a.exe

windows7_x64

10

060a70c364...2a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    060a70c364f54b43c8227cd6fe6474f8d37e55c174057da82f81c2e6748bac2a

  • Size

    36KB

  • Sample

    220212-mww3dsdafm

  • MD5

    069be2a2de10eeb2e668062fd079cb77

  • SHA1

    47ef673a9c6dc1bf453e06215052385c591d4db1

  • SHA256

    060a70c364f54b43c8227cd6fe6474f8d37e55c174057da82f81c2e6748bac2a

  • SHA512

    2077b4467f450aaf7ca7e87659295c5e3ab2c15ce8b49e58800b3167bbf6f94412bbbc45a0caada71c7b187bc79c48349935cada7ba0445d50ee419e2f7d6b48

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      060a70c364f54b43c8227cd6fe6474f8d37e55c174057da82f81c2e6748bac2a

    • Size

      36KB

    • MD5

      069be2a2de10eeb2e668062fd079cb77

    • SHA1

      47ef673a9c6dc1bf453e06215052385c591d4db1

    • SHA256

      060a70c364f54b43c8227cd6fe6474f8d37e55c174057da82f81c2e6748bac2a

    • SHA512

      2077b4467f450aaf7ca7e87659295c5e3ab2c15ce8b49e58800b3167bbf6f94412bbbc45a0caada71c7b187bc79c48349935cada7ba0445d50ee419e2f7d6b48

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks