Overview

overview

10

Static

static

04998aa82b...8e.exe

windows7_x64

10

04998aa82b...8e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04998aa82bd1c741c990edd11dd95137df1842d025c217f429ddde1d1e43b58e

  • Size

    58KB

  • Sample

    220212-nga22sbfg7

  • MD5

    c03c3457b4e3d45975406a5ca56439d2

  • SHA1

    e16698de86f63c20307a6ffb14ceeda8ba988fa9

  • SHA256

    04998aa82bd1c741c990edd11dd95137df1842d025c217f429ddde1d1e43b58e

  • SHA512

    6097e4a512bc284cc85073b5616d10ff69de55faea118581f46c19b222a597e33cfee7bba5bd56929c3ba2f3018f0a6f1079e8c4530b405afac587bdd792f4e4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04998aa82bd1c741c990edd11dd95137df1842d025c217f429ddde1d1e43b58e

    • Size

      58KB

    • MD5

      c03c3457b4e3d45975406a5ca56439d2

    • SHA1

      e16698de86f63c20307a6ffb14ceeda8ba988fa9

    • SHA256

      04998aa82bd1c741c990edd11dd95137df1842d025c217f429ddde1d1e43b58e

    • SHA512

      6097e4a512bc284cc85073b5616d10ff69de55faea118581f46c19b222a597e33cfee7bba5bd56929c3ba2f3018f0a6f1079e8c4530b405afac587bdd792f4e4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks