Overview

overview

10

Static

static

10

05dd157417...d1.exe

windows7_x64

10

05dd157417...d1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05dd157417f9e7514db2dc5775701d250ff8d99060bce4144e4321aef617ddd1

  • Size

    216KB

  • Sample

    220212-mzr8lsbdg9

  • MD5

    69fd584b82e33c033fb8a076167838de

  • SHA1

    0d1dc3bc0b8a77e9bba8cfba7fc77b6295eea8f1

  • SHA256

    05dd157417f9e7514db2dc5775701d250ff8d99060bce4144e4321aef617ddd1

  • SHA512

    a825feb90f1614bc8c58a280f9452556b4f156ed7a3a0d7de7946676172c2c9400f948d13028529e7fb2784a75f251967166409d130d796971d33ed98599cca6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      05dd157417f9e7514db2dc5775701d250ff8d99060bce4144e4321aef617ddd1

    • Size

      216KB

    • MD5

      69fd584b82e33c033fb8a076167838de

    • SHA1

      0d1dc3bc0b8a77e9bba8cfba7fc77b6295eea8f1

    • SHA256

      05dd157417f9e7514db2dc5775701d250ff8d99060bce4144e4321aef617ddd1

    • SHA512

      a825feb90f1614bc8c58a280f9452556b4f156ed7a3a0d7de7946676172c2c9400f948d13028529e7fb2784a75f251967166409d130d796971d33ed98599cca6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks