Overview

overview

10

Static

static

0230896528...96.exe

windows7_x64

10

0230896528...96.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    023089652895bf9582df90808c287883201aac56679b405d03931a2e4f7fde96

  • Size

    35KB

  • Sample

    220212-pd1zqscbc8

  • MD5

    9101fd86a494f4944c1abcdd322226fe

  • SHA1

    5975ff906549d4ff367602a07b22a827bfd659b3

  • SHA256

    023089652895bf9582df90808c287883201aac56679b405d03931a2e4f7fde96

  • SHA512

    e1bd788e3830e33936f7435a69df14e586679395e4862394f9dab12e87a2b4f1a92df2d00a9947c3751e59b9ac64d6e7725523b4cda8b43a3fde55f5b80f6583

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      023089652895bf9582df90808c287883201aac56679b405d03931a2e4f7fde96

    • Size

      35KB

    • MD5

      9101fd86a494f4944c1abcdd322226fe

    • SHA1

      5975ff906549d4ff367602a07b22a827bfd659b3

    • SHA256

      023089652895bf9582df90808c287883201aac56679b405d03931a2e4f7fde96

    • SHA512

      e1bd788e3830e33936f7435a69df14e586679395e4862394f9dab12e87a2b4f1a92df2d00a9947c3751e59b9ac64d6e7725523b4cda8b43a3fde55f5b80f6583

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks