Overview

overview

10

Static

static

10

04fa2c73e5...b2.exe

windows7_x64

10

04fa2c73e5...b2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04fa2c73e57f0463aeb422c7d94044d2443ea6d119026166fec5fd777debaeb2

  • Size

    101KB

  • Sample

    220212-nbp9sabfc6

  • MD5

    933e1530c02a5e73a4a8d1dc26e260a1

  • SHA1

    b67728bf253d9b1c1de8a735f0b7b60398125a21

  • SHA256

    04fa2c73e57f0463aeb422c7d94044d2443ea6d119026166fec5fd777debaeb2

  • SHA512

    a1145bac210795a9b646ecaaa5e8a4cec88aee28c8d11c6ca1a34a8f25728b3bcf175713b5c450104ce48bcd8d6e1a5c812dcfeb1a7bedfe126f477f607c6a8e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04fa2c73e57f0463aeb422c7d94044d2443ea6d119026166fec5fd777debaeb2

    • Size

      101KB

    • MD5

      933e1530c02a5e73a4a8d1dc26e260a1

    • SHA1

      b67728bf253d9b1c1de8a735f0b7b60398125a21

    • SHA256

      04fa2c73e57f0463aeb422c7d94044d2443ea6d119026166fec5fd777debaeb2

    • SHA512

      a1145bac210795a9b646ecaaa5e8a4cec88aee28c8d11c6ca1a34a8f25728b3bcf175713b5c450104ce48bcd8d6e1a5c812dcfeb1a7bedfe126f477f607c6a8e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks