Overview

overview

10

Static

static

02e3a838e1...64.exe

windows7_x64

10

02e3a838e1...64.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02e3a838e19853753be2995152e5c9c561c7104431adc68f72b685c0cc08a264

  • Size

    58KB

  • Sample

    220212-n4vpzacab8

  • MD5

    b0e31b1a03b61a3ac449533012ef1116

  • SHA1

    43a1ef4b0b0bf0f0749b0ab9dd5d3a20f823625d

  • SHA256

    02e3a838e19853753be2995152e5c9c561c7104431adc68f72b685c0cc08a264

  • SHA512

    bc95cd109dca9e075bbc4dda6a7cc47a39c60682e0c4ab4c9b326b3038dcff6a12f2af289b9ee22e7132acb046f57991ce643b1dd24e6a8531a17600e5e60bb7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02e3a838e19853753be2995152e5c9c561c7104431adc68f72b685c0cc08a264

    • Size

      58KB

    • MD5

      b0e31b1a03b61a3ac449533012ef1116

    • SHA1

      43a1ef4b0b0bf0f0749b0ab9dd5d3a20f823625d

    • SHA256

      02e3a838e19853753be2995152e5c9c561c7104431adc68f72b685c0cc08a264

    • SHA512

      bc95cd109dca9e075bbc4dda6a7cc47a39c60682e0c4ab4c9b326b3038dcff6a12f2af289b9ee22e7132acb046f57991ce643b1dd24e6a8531a17600e5e60bb7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks