Overview

overview

10

Static

static

04e00fdf86...80.exe

windows7_x64

10

04e00fdf86...80.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04e00fdf86153634767ff480b0e419cf87f6e251063006111eede0a06ef1f280

  • Size

    36KB

  • Sample

    220212-ncsrasdcfj

  • MD5

    0d26bf47cd223b1ad36a7a928631c8ce

  • SHA1

    72f694798b038fef47355697af78cf080d093d59

  • SHA256

    04e00fdf86153634767ff480b0e419cf87f6e251063006111eede0a06ef1f280

  • SHA512

    eb5c41cfa3b9520e716c0b9103cae3c22bbbb56e83926600752421c7e7397c1b8cc6fc49dc06dd51558b9e55049144f4f698d69435317d70be32627dcd2310f1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04e00fdf86153634767ff480b0e419cf87f6e251063006111eede0a06ef1f280

    • Size

      36KB

    • MD5

      0d26bf47cd223b1ad36a7a928631c8ce

    • SHA1

      72f694798b038fef47355697af78cf080d093d59

    • SHA256

      04e00fdf86153634767ff480b0e419cf87f6e251063006111eede0a06ef1f280

    • SHA512

      eb5c41cfa3b9520e716c0b9103cae3c22bbbb56e83926600752421c7e7397c1b8cc6fc49dc06dd51558b9e55049144f4f698d69435317d70be32627dcd2310f1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks