Overview

overview

10

Static

static

027c99e939...44.exe

windows7_x64

10

027c99e939...44.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    027c99e93933dec54fdf8217b5adb562dfdb6895755a9f0280a49aade5416344

  • Size

    58KB

  • Sample

    220212-n9yc2scag5

  • MD5

    49a7c64339ec9bdddf2df020a17cede0

  • SHA1

    9c64eeda151e9e500c4f8ef12e2b00ecf3f96ca6

  • SHA256

    027c99e93933dec54fdf8217b5adb562dfdb6895755a9f0280a49aade5416344

  • SHA512

    675999f59cdaba05bf609e1cfd805b47da7ca3f4f12efc139d24d90422f3a735e2045509c033b1eaa39e69788f8406e7dd0421bd956f0ee2c2d599e5b0a54c2f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      027c99e93933dec54fdf8217b5adb562dfdb6895755a9f0280a49aade5416344

    • Size

      58KB

    • MD5

      49a7c64339ec9bdddf2df020a17cede0

    • SHA1

      9c64eeda151e9e500c4f8ef12e2b00ecf3f96ca6

    • SHA256

      027c99e93933dec54fdf8217b5adb562dfdb6895755a9f0280a49aade5416344

    • SHA512

      675999f59cdaba05bf609e1cfd805b47da7ca3f4f12efc139d24d90422f3a735e2045509c033b1eaa39e69788f8406e7dd0421bd956f0ee2c2d599e5b0a54c2f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks