Overview

overview

10

Static

static

030f2a3af2...a4.exe

windows7_x64

10

030f2a3af2...a4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4

  • Size

    58KB

  • Sample

    220212-n3d1tsbhh7

  • MD5

    e4d72dcb3be2cc0babb0d1c82ddfc284

  • SHA1

    524ea40f8f5a8eec06c4a3e80c8874cfed91c89c

  • SHA256

    030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4

  • SHA512

    e2359fafa57cb8d45457ffb72b8fc06ece04033d8af598b8c54f6b2ca511b8a05a9613324114dea25420cd70a574bed07bcf6d91d1be2fea1d63a1bae59b7be1

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4

    • Size

      58KB

    • MD5

      e4d72dcb3be2cc0babb0d1c82ddfc284

    • SHA1

      524ea40f8f5a8eec06c4a3e80c8874cfed91c89c

    • SHA256

      030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4

    • SHA512

      e2359fafa57cb8d45457ffb72b8fc06ece04033d8af598b8c54f6b2ca511b8a05a9613324114dea25420cd70a574bed07bcf6d91d1be2fea1d63a1bae59b7be1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks