Overview

overview

10

Static

static

04ea93a8bc...ec.exe

windows7_x64

10

04ea93a8bc...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04ea93a8bcb4c9df7f8d8f804dcfd085c7288f9e26b9246810a6a92f7ee7f4ec

  • Size

    58KB

  • Sample

    220212-ncgn2abfc8

  • MD5

    e8d7a7eaf9a211f776b41cf2dda37def

  • SHA1

    0b742e778d596e4f62cd933146b490910f36cbb0

  • SHA256

    04ea93a8bcb4c9df7f8d8f804dcfd085c7288f9e26b9246810a6a92f7ee7f4ec

  • SHA512

    692004d2f9ce132023139da068eb37a33def91fc2cfefb63f6a1e0e1fbc51f259911a92bc045cf179a8bcc140077c7db325e7901edfb0996d9672742cb17deba

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04ea93a8bcb4c9df7f8d8f804dcfd085c7288f9e26b9246810a6a92f7ee7f4ec

    • Size

      58KB

    • MD5

      e8d7a7eaf9a211f776b41cf2dda37def

    • SHA1

      0b742e778d596e4f62cd933146b490910f36cbb0

    • SHA256

      04ea93a8bcb4c9df7f8d8f804dcfd085c7288f9e26b9246810a6a92f7ee7f4ec

    • SHA512

      692004d2f9ce132023139da068eb37a33def91fc2cfefb63f6a1e0e1fbc51f259911a92bc045cf179a8bcc140077c7db325e7901edfb0996d9672742cb17deba

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks