Overview

overview

10

Static

static

023c44af72...9f.exe

windows7_x64

10

023c44af72...9f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    023c44af72b9096439765645a246d69f6ebf8b71bf340f6a641501114cd3be9f

  • Size

    60KB

  • Sample

    220212-pdmr4scbc3

  • MD5

    c12c164fadc9dc2fbde19835dbedcfd9

  • SHA1

    e495ab36c0c00c618b30c451c977acf3a0aaa5eb

  • SHA256

    023c44af72b9096439765645a246d69f6ebf8b71bf340f6a641501114cd3be9f

  • SHA512

    fef09c35f447e978a79f64c470812028c144f683f181a9c2d05ce12fa729eec026f974e2516281309a8c4e8196e282fc5cbbb38485d30dbf7e0cf5aa5ebf8fac

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      023c44af72b9096439765645a246d69f6ebf8b71bf340f6a641501114cd3be9f

    • Size

      60KB

    • MD5

      c12c164fadc9dc2fbde19835dbedcfd9

    • SHA1

      e495ab36c0c00c618b30c451c977acf3a0aaa5eb

    • SHA256

      023c44af72b9096439765645a246d69f6ebf8b71bf340f6a641501114cd3be9f

    • SHA512

      fef09c35f447e978a79f64c470812028c144f683f181a9c2d05ce12fa729eec026f974e2516281309a8c4e8196e282fc5cbbb38485d30dbf7e0cf5aa5ebf8fac

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks