Overview

overview

10

Static

static

10

0267cfc173...49.exe

windows7_x64

10

0267cfc173...49.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0267cfc1731b7d17a2d60c7fa7436d60e583c69a0d462bd965edf8657bf2e549

  • Size

    216KB

  • Sample

    220212-pbezgscba3

  • MD5

    00d3dde4aec79b13357e50c297a4ed0a

  • SHA1

    451b0b2a1c2e4af349bc0a9a027ede3c83cad5e4

  • SHA256

    0267cfc1731b7d17a2d60c7fa7436d60e583c69a0d462bd965edf8657bf2e549

  • SHA512

    fc3707824c4dbe4a12df11a8434df597e76d7528bef9179aef6994f266f7b56a27ae043f071506e9ad6fcc04b03372894495bf7acad976f79c944f852b011b3b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0267cfc1731b7d17a2d60c7fa7436d60e583c69a0d462bd965edf8657bf2e549

    • Size

      216KB

    • MD5

      00d3dde4aec79b13357e50c297a4ed0a

    • SHA1

      451b0b2a1c2e4af349bc0a9a027ede3c83cad5e4

    • SHA256

      0267cfc1731b7d17a2d60c7fa7436d60e583c69a0d462bd965edf8657bf2e549

    • SHA512

      fc3707824c4dbe4a12df11a8434df597e76d7528bef9179aef6994f266f7b56a27ae043f071506e9ad6fcc04b03372894495bf7acad976f79c944f852b011b3b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks