Overview

overview

10

Static

static

10

c0064a70b0...43.exe

windows7_x64

10

c0064a70b0...43.exe

windows10_x64

10

c0064a70b0...43.exe

windows10-2004_x64

10

Resubmissions

24-02-2022 11:08

220224-m8v1vschc4 10

30-09-2021 12:24

210930-pk2jvahghl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0064a70b0d297c43ccc230f852c1ffac7534d58251dec497bab0e7e82f79143

  • Size

    216KB

  • Sample

    220224-m8v1vschc4

  • MD5

    dab5f66a4c8f6bcbcdeb2a83c21769c5

  • SHA1

    06e8c2999917c6bc5d4b6359de3222d4379acbb9

  • SHA256

    c0064a70b0d297c43ccc230f852c1ffac7534d58251dec497bab0e7e82f79143

  • SHA512

    3a02669cd6390e5c6b5e1dd8711c300790cd78419a512830325c497fad7a5864aeaac6e0622dd39ab3bd3bafad49f5ad968d0d6c24c961adb9cafb7b64869854

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      c0064a70b0d297c43ccc230f852c1ffac7534d58251dec497bab0e7e82f79143

    • Size

      216KB

    • MD5

      dab5f66a4c8f6bcbcdeb2a83c21769c5

    • SHA1

      06e8c2999917c6bc5d4b6359de3222d4379acbb9

    • SHA256

      c0064a70b0d297c43ccc230f852c1ffac7534d58251dec497bab0e7e82f79143

    • SHA512

      3a02669cd6390e5c6b5e1dd8711c300790cd78419a512830325c497fad7a5864aeaac6e0622dd39ab3bd3bafad49f5ad968d0d6c24c961adb9cafb7b64869854

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks