Overview

overview

10

Static

static

042b6d8bf5...54.exe

windows7_x64

10

042b6d8bf5...54.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    042b6d8bf51e045ceab0a86d2847c2f172dd80545be003d29f10bf665871f754

  • Size

    58KB

  • Sample

    220212-nna1maddhr

  • MD5

    8cca2dd08e8edd1c38c5d8e8fd5fa60a

  • SHA1

    eae31063a630a09a3e57cfeb421dcced13ce6f42

  • SHA256

    042b6d8bf51e045ceab0a86d2847c2f172dd80545be003d29f10bf665871f754

  • SHA512

    0fa54094ab578a81cd049ac98b2ce245d1a08f1db8993678b9d23853fdb91d5c1901f145d8ae745f6ee09710a22a0f360f8083ca7a3b02c618f482ef586b66fb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      042b6d8bf51e045ceab0a86d2847c2f172dd80545be003d29f10bf665871f754

    • Size

      58KB

    • MD5

      8cca2dd08e8edd1c38c5d8e8fd5fa60a

    • SHA1

      eae31063a630a09a3e57cfeb421dcced13ce6f42

    • SHA256

      042b6d8bf51e045ceab0a86d2847c2f172dd80545be003d29f10bf665871f754

    • SHA512

      0fa54094ab578a81cd049ac98b2ce245d1a08f1db8993678b9d23853fdb91d5c1901f145d8ae745f6ee09710a22a0f360f8083ca7a3b02c618f482ef586b66fb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks