Overview

overview

10

Static

static

10

05f10f65b9...98.exe

windows7_x64

10

05f10f65b9...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05f10f65b9b8835c1daa927a2edad27e9bc4b596fffcfadd0e9a81833fe34c98

  • Size

    92KB

  • Sample

    220212-myn5kabdf5

  • MD5

    be0e7f3577247216dd46c324ccaf10c6

  • SHA1

    26927770c50bff232ad96cf2bcc9fa0982d14069

  • SHA256

    05f10f65b9b8835c1daa927a2edad27e9bc4b596fffcfadd0e9a81833fe34c98

  • SHA512

    66be7d2ab7bc1d5848a0b397a1b7887ba6149f446903357cb28b4269da31e5da0b462ab426fe3970efc295f08303314c886c3f31cd954c53dc28310b33df692b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05f10f65b9b8835c1daa927a2edad27e9bc4b596fffcfadd0e9a81833fe34c98

    • Size

      92KB

    • MD5

      be0e7f3577247216dd46c324ccaf10c6

    • SHA1

      26927770c50bff232ad96cf2bcc9fa0982d14069

    • SHA256

      05f10f65b9b8835c1daa927a2edad27e9bc4b596fffcfadd0e9a81833fe34c98

    • SHA512

      66be7d2ab7bc1d5848a0b397a1b7887ba6149f446903357cb28b4269da31e5da0b462ab426fe3970efc295f08303314c886c3f31cd954c53dc28310b33df692b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks