Overview

overview

10

Static

static

10

04a2e3b5d9...2c.exe

windows7_x64

10

04a2e3b5d9...2c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c

  • Size

    216KB

  • Sample

    220212-nflr6abff8

  • MD5

    6cb110e70e3a7d6d2d69a9bf829d24dd

  • SHA1

    4552f20f64f73da4d51597950611b4c72dcf8716

  • SHA256

    04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c

  • SHA512

    3e4fb9a9c5729e23aceefca097a53824dbdffb9a3bc7ea0a6c4f444d7156257f3f1615a61b0bc47ab7d8e20b48a4ccb4fb9bd6db508d735f55fd9a1aa657743d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c

    • Size

      216KB

    • MD5

      6cb110e70e3a7d6d2d69a9bf829d24dd

    • SHA1

      4552f20f64f73da4d51597950611b4c72dcf8716

    • SHA256

      04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c

    • SHA512

      3e4fb9a9c5729e23aceefca097a53824dbdffb9a3bc7ea0a6c4f444d7156257f3f1615a61b0bc47ab7d8e20b48a4ccb4fb9bd6db508d735f55fd9a1aa657743d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks