Overview

overview

10

Static

static

10

005fd6dbed...b0.exe

windows7_x64

10

005fd6dbed...b0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    005fd6dbed96dc3a9cb190326be4d4c8ceb820022b1ee2498d900c9a2655dfb0

  • Size

    191KB

  • Sample

    220212-p126baebhq

  • MD5

    04f2391f092760a14798805ac1a19728

  • SHA1

    43db8226ccca8354b265493193329d8afb623881

  • SHA256

    005fd6dbed96dc3a9cb190326be4d4c8ceb820022b1ee2498d900c9a2655dfb0

  • SHA512

    1e8fb874719c5f8db30be71a761fac0fc378648265bc6d4dff8036c5f5f7ab7f1c2a1dd030ba1d7c779d0b56fddc687daf2950c6a4f7dd85bd4871e574065c47

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      005fd6dbed96dc3a9cb190326be4d4c8ceb820022b1ee2498d900c9a2655dfb0

    • Size

      191KB

    • MD5

      04f2391f092760a14798805ac1a19728

    • SHA1

      43db8226ccca8354b265493193329d8afb623881

    • SHA256

      005fd6dbed96dc3a9cb190326be4d4c8ceb820022b1ee2498d900c9a2655dfb0

    • SHA512

      1e8fb874719c5f8db30be71a761fac0fc378648265bc6d4dff8036c5f5f7ab7f1c2a1dd030ba1d7c779d0b56fddc687daf2950c6a4f7dd85bd4871e574065c47

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks