Overview

overview

10

Static

static

044c6ecad7...97.exe

windows7_x64

10

044c6ecad7...97.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    044c6ecad731d819d0baeb6b68a6b3a77149538da389832c3be7205aa4151497

  • Size

    58KB

  • Sample

    220212-nlkr2sddfp

  • MD5

    c95bfc7ca329e7bc37b3d3dcc36ab982

  • SHA1

    f8e32174ddeea58d474c75ba1b2d0d14b3cc416c

  • SHA256

    044c6ecad731d819d0baeb6b68a6b3a77149538da389832c3be7205aa4151497

  • SHA512

    d9960cbb9a0969a7e43890e5ef2cadc13d8bf1ce071958075755b0ea4d95b7d848f067b8ca4ac6d3c9836f53bcad91575df29634f4303243fb1889a3377bbdc7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      044c6ecad731d819d0baeb6b68a6b3a77149538da389832c3be7205aa4151497

    • Size

      58KB

    • MD5

      c95bfc7ca329e7bc37b3d3dcc36ab982

    • SHA1

      f8e32174ddeea58d474c75ba1b2d0d14b3cc416c

    • SHA256

      044c6ecad731d819d0baeb6b68a6b3a77149538da389832c3be7205aa4151497

    • SHA512

      d9960cbb9a0969a7e43890e5ef2cadc13d8bf1ce071958075755b0ea4d95b7d848f067b8ca4ac6d3c9836f53bcad91575df29634f4303243fb1889a3377bbdc7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks