Overview

overview

10

Static

static

0276e4d5cf...2c.exe

windows7_x64

10

0276e4d5cf...2c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c

  • Size

    60KB

  • Sample

    220212-n992vacag9

  • MD5

    6bcf49d8fa9052101e6746e7f19a4035

  • SHA1

    b4b89bae8c661f1b2f502572b42ca9aa1efb2be9

  • SHA256

    0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c

  • SHA512

    3a3c82f6eadf0dff94a394650983899bdbad6721c1482028aadfd2ff94e8adf8e658681924e721213aaf517a81221c8eee1e8ac02c2380813a3bede70ec94cb9

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c

    • Size

      60KB

    • MD5

      6bcf49d8fa9052101e6746e7f19a4035

    • SHA1

      b4b89bae8c661f1b2f502572b42ca9aa1efb2be9

    • SHA256

      0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c

    • SHA512

      3a3c82f6eadf0dff94a394650983899bdbad6721c1482028aadfd2ff94e8adf8e658681924e721213aaf517a81221c8eee1e8ac02c2380813a3bede70ec94cb9

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks