Overview

overview

10

Static

static

05e8b19c0e...11.exe

windows7_x64

10

05e8b19c0e...11.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05e8b19c0edd680e2adcdca9289b22916ead86a36938e66e93d20eb4662c7f11

  • Size

    36KB

  • Sample

    220212-my9fhabdg3

  • MD5

    0bae7f3a8e4bccff079c3da66b424abc

  • SHA1

    c4986880881c3772e08cf21c8a9768732c59d72e

  • SHA256

    05e8b19c0edd680e2adcdca9289b22916ead86a36938e66e93d20eb4662c7f11

  • SHA512

    91d772e429c1c3ecddc2368f7e4d8fc2f7c7155244f58361295d92b3bbad170bb00bcdbaa3e866c64ae3debdd409b3e4fffe4fced1d3b4ff86ddae55596175a3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05e8b19c0edd680e2adcdca9289b22916ead86a36938e66e93d20eb4662c7f11

    • Size

      36KB

    • MD5

      0bae7f3a8e4bccff079c3da66b424abc

    • SHA1

      c4986880881c3772e08cf21c8a9768732c59d72e

    • SHA256

      05e8b19c0edd680e2adcdca9289b22916ead86a36938e66e93d20eb4662c7f11

    • SHA512

      91d772e429c1c3ecddc2368f7e4d8fc2f7c7155244f58361295d92b3bbad170bb00bcdbaa3e866c64ae3debdd409b3e4fffe4fced1d3b4ff86ddae55596175a3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks