Overview

overview

10

Static

static

0479422a36...07.exe

windows7_x64

10

0479422a36...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0479422a36024c0dfb70f411c338b46803a71b596d0efdfdd063116f4e5dfd07

  • Size

    58KB

  • Sample

    220212-nh6kcaddcp

  • MD5

    b637a300dfd450e232251080010c3ec5

  • SHA1

    ec23ae71300caff49a0f6e2a792b9a97676e268e

  • SHA256

    0479422a36024c0dfb70f411c338b46803a71b596d0efdfdd063116f4e5dfd07

  • SHA512

    2196598fab8dc38426aa3cf0ac4056348e91c2e5e9dc1ec3137b58027a3c1319889a5fbcb0ebd91a0611dafcad5af7acfbd0e70f7b29b2478f97868e2c074419

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0479422a36024c0dfb70f411c338b46803a71b596d0efdfdd063116f4e5dfd07

    • Size

      58KB

    • MD5

      b637a300dfd450e232251080010c3ec5

    • SHA1

      ec23ae71300caff49a0f6e2a792b9a97676e268e

    • SHA256

      0479422a36024c0dfb70f411c338b46803a71b596d0efdfdd063116f4e5dfd07

    • SHA512

      2196598fab8dc38426aa3cf0ac4056348e91c2e5e9dc1ec3137b58027a3c1319889a5fbcb0ebd91a0611dafcad5af7acfbd0e70f7b29b2478f97868e2c074419

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks