Overview

overview

10

Static

static

10

0c03fbac3f...94.exe

windows7_x64

10

0c03fbac3f...94.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94

  • Size

    99KB

  • Sample

    220212-jvq8zabdfp

  • MD5

    4b3c83649fd0cece7bf6c200e363b4d4

  • SHA1

    a89e3aa73f1a54b166bf6f9635adc73ac2192235

  • SHA256

    0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94

  • SHA512

    e159d09beafce0663015de20b79472b6251184c6ef9ff226f7bf13b1274db4e2b72c81e48b470ab7587e93a0f7dab30fb0bb07ec4e498457d50adef5c494ced6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94

    • Size

      99KB

    • MD5

      4b3c83649fd0cece7bf6c200e363b4d4

    • SHA1

      a89e3aa73f1a54b166bf6f9635adc73ac2192235

    • SHA256

      0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94

    • SHA512

      e159d09beafce0663015de20b79472b6251184c6ef9ff226f7bf13b1274db4e2b72c81e48b470ab7587e93a0f7dab30fb0bb07ec4e498457d50adef5c494ced6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks