Overview

overview

10

Static

static

04a9e73011...3a.exe

windows7_x64

10

04a9e73011...3a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04a9e73011ec65d237691f25eb66e0bc050dc8d2c3ad87cfc11e5494c046823a

  • Size

    36KB

  • Sample

    220212-nfct9addaj

  • MD5

    7dd4a038065d7d9cbfe6491f50772f56

  • SHA1

    1171815db87ecfeed9258e19ce006cdef44e4ce2

  • SHA256

    04a9e73011ec65d237691f25eb66e0bc050dc8d2c3ad87cfc11e5494c046823a

  • SHA512

    484db02cbb93a944819b25736fb1052de448e30d4288682da2070360b3e006dc4f88fb824c95fa2c7b728ed7a99c6953ada1504b72292da1588328342e45df50

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04a9e73011ec65d237691f25eb66e0bc050dc8d2c3ad87cfc11e5494c046823a

    • Size

      36KB

    • MD5

      7dd4a038065d7d9cbfe6491f50772f56

    • SHA1

      1171815db87ecfeed9258e19ce006cdef44e4ce2

    • SHA256

      04a9e73011ec65d237691f25eb66e0bc050dc8d2c3ad87cfc11e5494c046823a

    • SHA512

      484db02cbb93a944819b25736fb1052de448e30d4288682da2070360b3e006dc4f88fb824c95fa2c7b728ed7a99c6953ada1504b72292da1588328342e45df50

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks