Overview

overview

10

Static

static

0e902ea052...39.exe

windows7_x64

10

0e902ea052...39.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e902ea0520cd3d1e5316b763925ec0aea96d54dbcb65d38118ff962545abc39

  • Size

    58KB

  • Sample

    220212-hwp7mahcg7

  • MD5

    e2b4b705c6b92cf2ef890e3412774487

  • SHA1

    158018fecd7e618914ed803360a103d4347ef505

  • SHA256

    0e902ea0520cd3d1e5316b763925ec0aea96d54dbcb65d38118ff962545abc39

  • SHA512

    4e52e3a765ff021b657e925ba73cc402f637d0d043bdfed6da8db5cf542c826041ecb694dc76c6f3e22169d0cac443abbb4340e89ca50b7f677d8aa50a65ec7f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0e902ea0520cd3d1e5316b763925ec0aea96d54dbcb65d38118ff962545abc39

    • Size

      58KB

    • MD5

      e2b4b705c6b92cf2ef890e3412774487

    • SHA1

      158018fecd7e618914ed803360a103d4347ef505

    • SHA256

      0e902ea0520cd3d1e5316b763925ec0aea96d54dbcb65d38118ff962545abc39

    • SHA512

      4e52e3a765ff021b657e925ba73cc402f637d0d043bdfed6da8db5cf542c826041ecb694dc76c6f3e22169d0cac443abbb4340e89ca50b7f677d8aa50a65ec7f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks