Overview

overview

10

Static

static

02f37dca67...7b.exe

windows7_x64

10

02f37dca67...7b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02f37dca67adea3eb9d52cbab976e0935ca6cfd756cfa29f868979b729f2847b

  • Size

    36KB

  • Sample

    220212-n31vlacaa7

  • MD5

    dac6ad8fed6f1cf4f209d1f597261673

  • SHA1

    65ac48c7f456cf9a3d2acd6c7e5a1478033d70cb

  • SHA256

    02f37dca67adea3eb9d52cbab976e0935ca6cfd756cfa29f868979b729f2847b

  • SHA512

    d2bd952a17331e01da534168566cbfd9832fc4698126cc39a5e15b936ecefa211f6a443762476b02a16fb68a00732009fe15baf06e1c46e91ab6610d6ca2d18f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02f37dca67adea3eb9d52cbab976e0935ca6cfd756cfa29f868979b729f2847b

    • Size

      36KB

    • MD5

      dac6ad8fed6f1cf4f209d1f597261673

    • SHA1

      65ac48c7f456cf9a3d2acd6c7e5a1478033d70cb

    • SHA256

      02f37dca67adea3eb9d52cbab976e0935ca6cfd756cfa29f868979b729f2847b

    • SHA512

      d2bd952a17331e01da534168566cbfd9832fc4698126cc39a5e15b936ecefa211f6a443762476b02a16fb68a00732009fe15baf06e1c46e91ab6610d6ca2d18f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks