Overview

overview

10

Static

static

10

018ef0603b...e9.exe

windows7_x64

10

018ef0603b...e9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    018ef0603bc5c4391a057b166981efb5839524d7dab31427d7382a523244aee9

  • Size

    80KB

  • Sample

    220212-plsckaccb8

  • MD5

    bf1abd49a7ae54f2f26f82517d176ec2

  • SHA1

    2db0eb2337978739d0575a63a9e7fff813583c56

  • SHA256

    018ef0603bc5c4391a057b166981efb5839524d7dab31427d7382a523244aee9

  • SHA512

    d073ab6f953ff711395895fd8775528ed8162b9786f9e814f572886848dd01a1f0ea789c41f1c092bdcfe4d34d18dfbf2e7aa69765ff85d134684da1385e1c2b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      018ef0603bc5c4391a057b166981efb5839524d7dab31427d7382a523244aee9

    • Size

      80KB

    • MD5

      bf1abd49a7ae54f2f26f82517d176ec2

    • SHA1

      2db0eb2337978739d0575a63a9e7fff813583c56

    • SHA256

      018ef0603bc5c4391a057b166981efb5839524d7dab31427d7382a523244aee9

    • SHA512

      d073ab6f953ff711395895fd8775528ed8162b9786f9e814f572886848dd01a1f0ea789c41f1c092bdcfe4d34d18dfbf2e7aa69765ff85d134684da1385e1c2b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks