Overview

overview

10

Static

static

10

01d25d323b...db.exe

windows7_x64

10

01d25d323b...db.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01d25d323b50f5c1b4649bf263326edb8f147fc8f1e9cfe550b2a3fa17f9e4db

  • Size

    192KB

  • Sample

    220212-phzmgadhgk

  • MD5

    f4430884ae3799d6592593ade06b9cf7

  • SHA1

    935f156a712b8293bfd021d948ddb4f23ad60220

  • SHA256

    01d25d323b50f5c1b4649bf263326edb8f147fc8f1e9cfe550b2a3fa17f9e4db

  • SHA512

    eb5b3bfd77290eb6a44909b2c9186660c089b5a93787088f8accbc27f7b568f8566f9a8f07520e7ad00e95e3452a69ab6d3ea10f8b6abb06387f05171ef3f119

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      01d25d323b50f5c1b4649bf263326edb8f147fc8f1e9cfe550b2a3fa17f9e4db

    • Size

      192KB

    • MD5

      f4430884ae3799d6592593ade06b9cf7

    • SHA1

      935f156a712b8293bfd021d948ddb4f23ad60220

    • SHA256

      01d25d323b50f5c1b4649bf263326edb8f147fc8f1e9cfe550b2a3fa17f9e4db

    • SHA512

      eb5b3bfd77290eb6a44909b2c9186660c089b5a93787088f8accbc27f7b568f8566f9a8f07520e7ad00e95e3452a69ab6d3ea10f8b6abb06387f05171ef3f119

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks