Overview

overview

10

Static

static

10

04fb087d0c...d6.exe

windows7_x64

10

04fb087d0c...d6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04fb087d0c26ef31f63cde18e0144daaf7aee04fd6c118c2fd8bca3a0dffc8d6

  • Size

    191KB

  • Sample

    220212-nbm5esbfc5

  • MD5

    11a61a50c20835a1a3d1b80b7dbbb30d

  • SHA1

    b9bb95ecd9bc37132719fa26de15d589add9e25c

  • SHA256

    04fb087d0c26ef31f63cde18e0144daaf7aee04fd6c118c2fd8bca3a0dffc8d6

  • SHA512

    6760bb7259a11acc28d8a9964698e74d4f661a5226c8f6ce779d7cde945023c6a493efa3ddb099eef090a601913e3be23b0c1863193a16890845650a5444e438

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04fb087d0c26ef31f63cde18e0144daaf7aee04fd6c118c2fd8bca3a0dffc8d6

    • Size

      191KB

    • MD5

      11a61a50c20835a1a3d1b80b7dbbb30d

    • SHA1

      b9bb95ecd9bc37132719fa26de15d589add9e25c

    • SHA256

      04fb087d0c26ef31f63cde18e0144daaf7aee04fd6c118c2fd8bca3a0dffc8d6

    • SHA512

      6760bb7259a11acc28d8a9964698e74d4f661a5226c8f6ce779d7cde945023c6a493efa3ddb099eef090a601913e3be23b0c1863193a16890845650a5444e438

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks