Overview

overview

10

Static

static

10

0207377544...30.exe

windows7_x64

10

0207377544...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0207377544fc5c7cc559b35aa60dcade254f351504c4250a771f7841f0edf830

  • Size

    80KB

  • Sample

    220212-pfs2xadhdp

  • MD5

    836aeabc1892f316ed039b50dd41ce1f

  • SHA1

    594984dcb0111c6ec393edf342b2a285cfbee754

  • SHA256

    0207377544fc5c7cc559b35aa60dcade254f351504c4250a771f7841f0edf830

  • SHA512

    77bf7962b4dc7d9f94f1d3d52440a4db53586cb1be8e5748c1caca03ee4e307bc4e24102f0d4346b7bf3d1c427766d6f596a660fdae1a551f8b220ceb78c4947

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0207377544fc5c7cc559b35aa60dcade254f351504c4250a771f7841f0edf830

    • Size

      80KB

    • MD5

      836aeabc1892f316ed039b50dd41ce1f

    • SHA1

      594984dcb0111c6ec393edf342b2a285cfbee754

    • SHA256

      0207377544fc5c7cc559b35aa60dcade254f351504c4250a771f7841f0edf830

    • SHA512

      77bf7962b4dc7d9f94f1d3d52440a4db53586cb1be8e5748c1caca03ee4e307bc4e24102f0d4346b7bf3d1c427766d6f596a660fdae1a551f8b220ceb78c4947

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks