Overview

overview

10

Static

static

10

0405f04b30...53.exe

windows7_x64

10

0405f04b30...53.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0405f04b30e8ec96a49c8bb2a765a72e41ef7f02eb91ce68a26d366042fa4c53

  • Size

    99KB

  • Sample

    220212-npqsgabgf4

  • MD5

    8e4581732d77198ec1683f1b63be7f0c

  • SHA1

    aa63ff94108f3c157327a1df4d56b17bab2f1910

  • SHA256

    0405f04b30e8ec96a49c8bb2a765a72e41ef7f02eb91ce68a26d366042fa4c53

  • SHA512

    0a3e454ac913d9dc5a30c4151d06a71438a76175aa420b960c6e807b140eba4ba0b55d59553e56fd5af5c6f189c8381205e9699440ae1ef8f5c1d8fa19ec998a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0405f04b30e8ec96a49c8bb2a765a72e41ef7f02eb91ce68a26d366042fa4c53

    • Size

      99KB

    • MD5

      8e4581732d77198ec1683f1b63be7f0c

    • SHA1

      aa63ff94108f3c157327a1df4d56b17bab2f1910

    • SHA256

      0405f04b30e8ec96a49c8bb2a765a72e41ef7f02eb91ce68a26d366042fa4c53

    • SHA512

      0a3e454ac913d9dc5a30c4151d06a71438a76175aa420b960c6e807b140eba4ba0b55d59553e56fd5af5c6f189c8381205e9699440ae1ef8f5c1d8fa19ec998a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks