Overview

overview

10

Static

static

023caee182...c7.exe

windows7_x64

10

023caee182...c7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    023caee18244e2b5fda5676c699ed420b40034ad6aefb5a3fa13a126d3641ac7

  • Size

    58KB

  • Sample

    220212-pdhs6acbc2

  • MD5

    0ef6d4d3928b89e0876d75ef7c461ecf

  • SHA1

    153cd6b7f495078ecf56f5842eee1d06ca0034a3

  • SHA256

    023caee18244e2b5fda5676c699ed420b40034ad6aefb5a3fa13a126d3641ac7

  • SHA512

    7cc214812b6971d5d068e0a526b02874190b74679a242120b241a97a2822c1fead3565afcfdaad173797f7200906a0ede19b299424e403d19912081c9a724715

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      023caee18244e2b5fda5676c699ed420b40034ad6aefb5a3fa13a126d3641ac7

    • Size

      58KB

    • MD5

      0ef6d4d3928b89e0876d75ef7c461ecf

    • SHA1

      153cd6b7f495078ecf56f5842eee1d06ca0034a3

    • SHA256

      023caee18244e2b5fda5676c699ed420b40034ad6aefb5a3fa13a126d3641ac7

    • SHA512

      7cc214812b6971d5d068e0a526b02874190b74679a242120b241a97a2822c1fead3565afcfdaad173797f7200906a0ede19b299424e403d19912081c9a724715

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks