Overview

overview

10

Static

static

049de85728...23.exe

windows7_x64

10

049de85728...23.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    049de85728a091b80f7fbd680956c0a17e4ec0d64047fca3683a3cda63f94623

  • Size

    36KB

  • Sample

    220212-nfzzsaddan

  • MD5

    0c7b4dfab30b291bcd446a54b5337156

  • SHA1

    a6185081cae3fbe24702a7e3465d25013b4af83e

  • SHA256

    049de85728a091b80f7fbd680956c0a17e4ec0d64047fca3683a3cda63f94623

  • SHA512

    14f56b5dd126a90ef0f8ac3544b589c97ec4e05c80079ca41c9a835339ac45196e60e75847ede38ced804940c5c511713020ae9fe0cdd64c23759573396ff8cd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      049de85728a091b80f7fbd680956c0a17e4ec0d64047fca3683a3cda63f94623

    • Size

      36KB

    • MD5

      0c7b4dfab30b291bcd446a54b5337156

    • SHA1

      a6185081cae3fbe24702a7e3465d25013b4af83e

    • SHA256

      049de85728a091b80f7fbd680956c0a17e4ec0d64047fca3683a3cda63f94623

    • SHA512

      14f56b5dd126a90ef0f8ac3544b589c97ec4e05c80079ca41c9a835339ac45196e60e75847ede38ced804940c5c511713020ae9fe0cdd64c23759573396ff8cd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks