Overview

overview

10

Static

static

04c20a84cc...45.exe

windows7_x64

10

04c20a84cc...45.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04c20a84cc1a3d77d160b2655130df143f3c5cbacd0568d5196b868ac5918745

  • Size

    60KB

  • Sample

    220212-nd7lvabfe5

  • MD5

    50b99fb19d5cf3685a3852e5f1182ef8

  • SHA1

    50428ecfebb663d152b956b71498d3535555762f

  • SHA256

    04c20a84cc1a3d77d160b2655130df143f3c5cbacd0568d5196b868ac5918745

  • SHA512

    acf189c0869c9c02f44aea4c18bc65cf98f9e0e0e910e6284856e6612b1dbc58437e6c6cf4d50fdaa5c0623a5fdccdda7b211d7a69b7cf5986e2495f49f6e29c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04c20a84cc1a3d77d160b2655130df143f3c5cbacd0568d5196b868ac5918745

    • Size

      60KB

    • MD5

      50b99fb19d5cf3685a3852e5f1182ef8

    • SHA1

      50428ecfebb663d152b956b71498d3535555762f

    • SHA256

      04c20a84cc1a3d77d160b2655130df143f3c5cbacd0568d5196b868ac5918745

    • SHA512

      acf189c0869c9c02f44aea4c18bc65cf98f9e0e0e910e6284856e6612b1dbc58437e6c6cf4d50fdaa5c0623a5fdccdda7b211d7a69b7cf5986e2495f49f6e29c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks