Overview

overview

10

Static

static

0430a366d8...b5.exe

windows7_x64

10

0430a366d8...b5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0430a366d8632121a8a56264b30c8805bfcf2e7cded87a7f03799e94e9a77eb5

  • Size

    60KB

  • Sample

    220212-nmr8hsddhm

  • MD5

    96de5d7d87207a6d3b8af0fd693a90c3

  • SHA1

    314b9b35a92d4e23eeda7d03b74bd62526f44370

  • SHA256

    0430a366d8632121a8a56264b30c8805bfcf2e7cded87a7f03799e94e9a77eb5

  • SHA512

    24d8bc31f38015f15a5f28e54030bc80c3217ac101ba331ca733196984071e6b91bf27c37af48ab24ae037afc8232eb3ff1a10a5d400680df7702825530136e0

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0430a366d8632121a8a56264b30c8805bfcf2e7cded87a7f03799e94e9a77eb5

    • Size

      60KB

    • MD5

      96de5d7d87207a6d3b8af0fd693a90c3

    • SHA1

      314b9b35a92d4e23eeda7d03b74bd62526f44370

    • SHA256

      0430a366d8632121a8a56264b30c8805bfcf2e7cded87a7f03799e94e9a77eb5

    • SHA512

      24d8bc31f38015f15a5f28e54030bc80c3217ac101ba331ca733196984071e6b91bf27c37af48ab24ae037afc8232eb3ff1a10a5d400680df7702825530136e0

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks