Overview

overview

10

Static

static

10

042f65d1b9...e4.exe

windows7_x64

10

042f65d1b9...e4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    042f65d1b9ebc0ff650af29b1e062c1d08de1af6481e3b6d96bf673da5162be4

  • Size

    79KB

  • Sample

    220212-nmzmladdhn

  • MD5

    51a4f190a4f8bcdb6bf1a10b6d45da52

  • SHA1

    1c6980a99758608fcc3da80ca0280252f6a7bc11

  • SHA256

    042f65d1b9ebc0ff650af29b1e062c1d08de1af6481e3b6d96bf673da5162be4

  • SHA512

    db3699d853a8f1c3fb611fbdfd687c0d963d93faa15ae59eec541b28d3ef6761cd6b02dfd85ad79aebfa933bfb171de77692966be18ae4b2e9bf26de71eafab7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      042f65d1b9ebc0ff650af29b1e062c1d08de1af6481e3b6d96bf673da5162be4

    • Size

      79KB

    • MD5

      51a4f190a4f8bcdb6bf1a10b6d45da52

    • SHA1

      1c6980a99758608fcc3da80ca0280252f6a7bc11

    • SHA256

      042f65d1b9ebc0ff650af29b1e062c1d08de1af6481e3b6d96bf673da5162be4

    • SHA512

      db3699d853a8f1c3fb611fbdfd687c0d963d93faa15ae59eec541b28d3ef6761cd6b02dfd85ad79aebfa933bfb171de77692966be18ae4b2e9bf26de71eafab7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks