Overview

overview

10

Static

static

10

044b752920...b9.exe

windows7_x64

10

044b752920...b9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    044b7529207314a1b456c706287bc80ce5b8a1423b5a3051a9ed1e5b08ae50b9

  • Size

    99KB

  • Sample

    220212-nlpq1addfq

  • MD5

    099464c4161ed353d710aadb83cd8e7c

  • SHA1

    582cee0ef60ecd41c7ff1a5b0680c2709df34edd

  • SHA256

    044b7529207314a1b456c706287bc80ce5b8a1423b5a3051a9ed1e5b08ae50b9

  • SHA512

    5cced9a05589d779e2cc7840ab4d8d824cdd1d48ff46823e30fe6772966bd07f23c2d5421051709520f21f83b6e37f24f1d2be398fa518dee9601f6238e0a9bf

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      044b7529207314a1b456c706287bc80ce5b8a1423b5a3051a9ed1e5b08ae50b9

    • Size

      99KB

    • MD5

      099464c4161ed353d710aadb83cd8e7c

    • SHA1

      582cee0ef60ecd41c7ff1a5b0680c2709df34edd

    • SHA256

      044b7529207314a1b456c706287bc80ce5b8a1423b5a3051a9ed1e5b08ae50b9

    • SHA512

      5cced9a05589d779e2cc7840ab4d8d824cdd1d48ff46823e30fe6772966bd07f23c2d5421051709520f21f83b6e37f24f1d2be398fa518dee9601f6238e0a9bf

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks