Overview

overview

10

Static

static

0229f7c796...e6.exe

windows7_x64

10

0229f7c796...e6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0229f7c7963c0c300a57d3248657a01fa57349778f3d16487cdd92114a55cde6

  • Size

    58KB

  • Sample

    220212-peccrscbd3

  • MD5

    63811168cd2de1eae0e5d0cd2682433e

  • SHA1

    0617cd2d2e6faa6a37569de3338da692fc4c470e

  • SHA256

    0229f7c7963c0c300a57d3248657a01fa57349778f3d16487cdd92114a55cde6

  • SHA512

    e7220ea8458b7fae22ae0358abc8209ae49d28f78ef68d1dce51fe3e680befc3d493ae98a69260125c3afa070edb850b36c1878695b9e67a8124cbdfd960cecd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0229f7c7963c0c300a57d3248657a01fa57349778f3d16487cdd92114a55cde6

    • Size

      58KB

    • MD5

      63811168cd2de1eae0e5d0cd2682433e

    • SHA1

      0617cd2d2e6faa6a37569de3338da692fc4c470e

    • SHA256

      0229f7c7963c0c300a57d3248657a01fa57349778f3d16487cdd92114a55cde6

    • SHA512

      e7220ea8458b7fae22ae0358abc8209ae49d28f78ef68d1dce51fe3e680befc3d493ae98a69260125c3afa070edb850b36c1878695b9e67a8124cbdfd960cecd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks