Overview

overview

10

Static

static

10

05de185145...d3.exe

windows7_x64

10

05de185145...d3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05de185145ee4285f9bf1b20d66b00c49f2ae367320fe98a95b009ee327cd0d3

  • Size

    100KB

  • Sample

    220212-mzmywsbdg7

  • MD5

    ce2ac0eca54a6a9e61a5a0584e43158c

  • SHA1

    1708f300d31ad2b65d865e715c306646b08f5587

  • SHA256

    05de185145ee4285f9bf1b20d66b00c49f2ae367320fe98a95b009ee327cd0d3

  • SHA512

    00ba903ee26ceda173aaf82a2f4f66e9dce3a858d57399d6679466d7ddcd44331b42f31a9763e2dd570325dfa85ca397f64aed3fb85f4487cdd9a22d933586bb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05de185145ee4285f9bf1b20d66b00c49f2ae367320fe98a95b009ee327cd0d3

    • Size

      100KB

    • MD5

      ce2ac0eca54a6a9e61a5a0584e43158c

    • SHA1

      1708f300d31ad2b65d865e715c306646b08f5587

    • SHA256

      05de185145ee4285f9bf1b20d66b00c49f2ae367320fe98a95b009ee327cd0d3

    • SHA512

      00ba903ee26ceda173aaf82a2f4f66e9dce3a858d57399d6679466d7ddcd44331b42f31a9763e2dd570325dfa85ca397f64aed3fb85f4487cdd9a22d933586bb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks