Overview

overview

10

Static

static

05d8c8070d...94.exe

windows7_x64

10

05d8c8070d...94.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05d8c8070d5f4514166442230f1f1b35114a6fe1cf0dba98ead5d46bd1a32494

  • Size

    58KB

  • Sample

    220212-mz16hsdahr

  • MD5

    5ac575469a24de65969a17c2f244ac45

  • SHA1

    b2043f6dec1426bb018d7d9927e8cb43063faf22

  • SHA256

    05d8c8070d5f4514166442230f1f1b35114a6fe1cf0dba98ead5d46bd1a32494

  • SHA512

    0cb41d4827fbc675c041792b91420e41233729018cec1fc6006a36f6976d3b7954299711650be2d63dabdb36748fd7b3dd6dac33fe0d86ebce0f650facbb9f91

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05d8c8070d5f4514166442230f1f1b35114a6fe1cf0dba98ead5d46bd1a32494

    • Size

      58KB

    • MD5

      5ac575469a24de65969a17c2f244ac45

    • SHA1

      b2043f6dec1426bb018d7d9927e8cb43063faf22

    • SHA256

      05d8c8070d5f4514166442230f1f1b35114a6fe1cf0dba98ead5d46bd1a32494

    • SHA512

      0cb41d4827fbc675c041792b91420e41233729018cec1fc6006a36f6976d3b7954299711650be2d63dabdb36748fd7b3dd6dac33fe0d86ebce0f650facbb9f91

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks