Overview

overview

10

Static

static

10

04e6443649...10.exe

windows7_x64

10

04e6443649...10.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04e6443649a72c12480752b4eeaa8eb43b50a830023b0cd8780d95b202abd010

  • Size

    89KB

  • Sample

    220212-ncnscabfd3

  • MD5

    edac9a8ce4b34e585e6d92537acd22ff

  • SHA1

    58ea5405038dbe1d964e765324d7e9d7b52f187f

  • SHA256

    04e6443649a72c12480752b4eeaa8eb43b50a830023b0cd8780d95b202abd010

  • SHA512

    102d11b08f80c1fe645a9ea6aed67707f92fb2c4c605e88051342233e544237036f8318fd704680f6a286ea0c3a80a930f2800fa5218bd1ca28009166cac4ef8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04e6443649a72c12480752b4eeaa8eb43b50a830023b0cd8780d95b202abd010

    • Size

      89KB

    • MD5

      edac9a8ce4b34e585e6d92537acd22ff

    • SHA1

      58ea5405038dbe1d964e765324d7e9d7b52f187f

    • SHA256

      04e6443649a72c12480752b4eeaa8eb43b50a830023b0cd8780d95b202abd010

    • SHA512

      102d11b08f80c1fe645a9ea6aed67707f92fb2c4c605e88051342233e544237036f8318fd704680f6a286ea0c3a80a930f2800fa5218bd1ca28009166cac4ef8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks