Overview

overview

10

Static

static

0334f02650...7f.exe

windows7_x64

10

0334f02650...7f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0334f02650ecee334886ae1aae71d61446c9529f08411e2f360badcd654e3d7f

  • Size

    35KB

  • Sample

    220212-n1sffabhg6

  • MD5

    70b60ab79b76c0bcba83c1acda9d540a

  • SHA1

    6117f7cbbfd343e76ce75e830887b91fc65f0d4e

  • SHA256

    0334f02650ecee334886ae1aae71d61446c9529f08411e2f360badcd654e3d7f

  • SHA512

    8b56e16347f047a4d567fdc4712aba2c2d80663042c60c50ea95516e0c897f03184309394d4e25e1dd45acbbc4b6f3b310336e81029694828aa79dda437ed593

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0334f02650ecee334886ae1aae71d61446c9529f08411e2f360badcd654e3d7f

    • Size

      35KB

    • MD5

      70b60ab79b76c0bcba83c1acda9d540a

    • SHA1

      6117f7cbbfd343e76ce75e830887b91fc65f0d4e

    • SHA256

      0334f02650ecee334886ae1aae71d61446c9529f08411e2f360badcd654e3d7f

    • SHA512

      8b56e16347f047a4d567fdc4712aba2c2d80663042c60c50ea95516e0c897f03184309394d4e25e1dd45acbbc4b6f3b310336e81029694828aa79dda437ed593

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks