Overview

overview

10

Static

static

048ef37796...c5.exe

windows7_x64

10

048ef37796...c5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    048ef37796b921efeb9e32d72691016bab7d86f9cea5ddd3f9a622b9a53867c5

  • Size

    35KB

  • Sample

    220212-ngrd2addbl

  • MD5

    81b21f113552a90b9ccef8fed2b7c561

  • SHA1

    e6c083be31b50c3481efeb7a185188597322616b

  • SHA256

    048ef37796b921efeb9e32d72691016bab7d86f9cea5ddd3f9a622b9a53867c5

  • SHA512

    66ea90602d23ccb3cacf822e1c634b455806006e962e65938b6adb941086af02814b907ce3d40c6be7cce5a4402d4fd715ac68c6c5969f71b4e32c25cda76c54

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      048ef37796b921efeb9e32d72691016bab7d86f9cea5ddd3f9a622b9a53867c5

    • Size

      35KB

    • MD5

      81b21f113552a90b9ccef8fed2b7c561

    • SHA1

      e6c083be31b50c3481efeb7a185188597322616b

    • SHA256

      048ef37796b921efeb9e32d72691016bab7d86f9cea5ddd3f9a622b9a53867c5

    • SHA512

      66ea90602d23ccb3cacf822e1c634b455806006e962e65938b6adb941086af02814b907ce3d40c6be7cce5a4402d4fd715ac68c6c5969f71b4e32c25cda76c54

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks