Overview

overview

10

Static

static

04be78573b...4c.exe

windows7_x64

10

04be78573b...4c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04be78573bcae2866760e87741641426db563ad7c7992212ff9aa8d952a3894c

  • Size

    36KB

  • Sample

    220212-nedp6adcgr

  • MD5

    5edb55fc3da27ce66ce804ade235dfa7

  • SHA1

    ee6b6e322c1aa6eca7b413588397b7d68c7436dc

  • SHA256

    04be78573bcae2866760e87741641426db563ad7c7992212ff9aa8d952a3894c

  • SHA512

    5a444a3a4d9da56cbfaccd209a1848c114e43ffdfd8361a8898a29017b45088eaf70e783dbe791d010f23b807e84a9fae5e018a3fabce783736e6d7f83b3fe85

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04be78573bcae2866760e87741641426db563ad7c7992212ff9aa8d952a3894c

    • Size

      36KB

    • MD5

      5edb55fc3da27ce66ce804ade235dfa7

    • SHA1

      ee6b6e322c1aa6eca7b413588397b7d68c7436dc

    • SHA256

      04be78573bcae2866760e87741641426db563ad7c7992212ff9aa8d952a3894c

    • SHA512

      5a444a3a4d9da56cbfaccd209a1848c114e43ffdfd8361a8898a29017b45088eaf70e783dbe791d010f23b807e84a9fae5e018a3fabce783736e6d7f83b3fe85

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks