Overview

overview

10

Static

static

10

05fe480140...9d.exe

windows7_x64

10

05fe480140...9d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05fe4801403f452e6c72d8b32efeb0345479c54c68bb073f076655b79ee2179d

  • Size

    101KB

  • Sample

    220212-mxvkysbde7

  • MD5

    ab24426b34f5634f03b8e4a067bd6044

  • SHA1

    87f105a64cee299e39927a61f491c38c75655567

  • SHA256

    05fe4801403f452e6c72d8b32efeb0345479c54c68bb073f076655b79ee2179d

  • SHA512

    b97ad395aff2506dbbc12f071c1495c60f84cfd6c663a41b1d2739558f78264ed089ebcad2ae1111ab00da79464efe492a2ed0707b0ca7e231c9b58fae81ac74

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05fe4801403f452e6c72d8b32efeb0345479c54c68bb073f076655b79ee2179d

    • Size

      101KB

    • MD5

      ab24426b34f5634f03b8e4a067bd6044

    • SHA1

      87f105a64cee299e39927a61f491c38c75655567

    • SHA256

      05fe4801403f452e6c72d8b32efeb0345479c54c68bb073f076655b79ee2179d

    • SHA512

      b97ad395aff2506dbbc12f071c1495c60f84cfd6c663a41b1d2739558f78264ed089ebcad2ae1111ab00da79464efe492a2ed0707b0ca7e231c9b58fae81ac74

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks