Overview

overview

10

Static

static

05fb07f5e1...bf.exe

windows7_x64

10

05fb07f5e1...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05fb07f5e1e3f20c1a6b656efa2e3108d32c55ed1398e778bc628d260a0754bf

  • Size

    36KB

  • Sample

    220212-mxzjxabde9

  • MD5

    5da558d17a8f6698bfc4ed264d5806e1

  • SHA1

    618577ed1a0f663a8aa7d88178f983919d85c7f5

  • SHA256

    05fb07f5e1e3f20c1a6b656efa2e3108d32c55ed1398e778bc628d260a0754bf

  • SHA512

    502f3b65452c3a96e3a9aaa8727c9f10c227d21881111717fee17a588c50a1c526a0182a7b7760f8e3efbc57363ec04e12e6b3b2539e4da0106637a5c00be977

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05fb07f5e1e3f20c1a6b656efa2e3108d32c55ed1398e778bc628d260a0754bf

    • Size

      36KB

    • MD5

      5da558d17a8f6698bfc4ed264d5806e1

    • SHA1

      618577ed1a0f663a8aa7d88178f983919d85c7f5

    • SHA256

      05fb07f5e1e3f20c1a6b656efa2e3108d32c55ed1398e778bc628d260a0754bf

    • SHA512

      502f3b65452c3a96e3a9aaa8727c9f10c227d21881111717fee17a588c50a1c526a0182a7b7760f8e3efbc57363ec04e12e6b3b2539e4da0106637a5c00be977

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks