Overview

overview

10

Static

static

10

04987294b5...8c.exe

windows7_x64

10

04987294b5...8c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04987294b5882639c61eb1b7e0101c4ecd6c0e781649bca8752d4cd48efb9c8c

  • Size

    101KB

  • Sample

    220212-ngcwmsddaq

  • MD5

    dc6f9a9b83bfff258ba040f7e2f3501c

  • SHA1

    bc0428d0bfe2b5be1f4a09fdf5c2b6dbe6250e39

  • SHA256

    04987294b5882639c61eb1b7e0101c4ecd6c0e781649bca8752d4cd48efb9c8c

  • SHA512

    f5cad8dba123a21cb6f75ef1c646f7d8f01f0a004dca7e58f4c51d1873ed8ef809edc3c8c2cf36589e2f5e81f67907abe08ff2c9d820eb2b19d7a4c44e9211a7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04987294b5882639c61eb1b7e0101c4ecd6c0e781649bca8752d4cd48efb9c8c

    • Size

      101KB

    • MD5

      dc6f9a9b83bfff258ba040f7e2f3501c

    • SHA1

      bc0428d0bfe2b5be1f4a09fdf5c2b6dbe6250e39

    • SHA256

      04987294b5882639c61eb1b7e0101c4ecd6c0e781649bca8752d4cd48efb9c8c

    • SHA512

      f5cad8dba123a21cb6f75ef1c646f7d8f01f0a004dca7e58f4c51d1873ed8ef809edc3c8c2cf36589e2f5e81f67907abe08ff2c9d820eb2b19d7a4c44e9211a7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks