Overview

overview

10

Static

static

02cfcdc462...61.exe

windows7_x64

10

02cfcdc462...61.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02cfcdc462714b186e05ae43f430a9adbac37273445ee2c561a04c0e3bed7761

  • Size

    35KB

  • Sample

    220212-n5wzesdgap

  • MD5

    8cafb41223f26193c89396684af43a25

  • SHA1

    7a85c7825db906e71b95e711a6502b186d8bc4b1

  • SHA256

    02cfcdc462714b186e05ae43f430a9adbac37273445ee2c561a04c0e3bed7761

  • SHA512

    e65d6e31407b70bde61cf96aa0e6c11a4c49937bcb3c7517742fac5509a92ba4c4104280c9fdbc925d52df765348f90a05b0c9df6d4ae7e3b9a49fd1195712b6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02cfcdc462714b186e05ae43f430a9adbac37273445ee2c561a04c0e3bed7761

    • Size

      35KB

    • MD5

      8cafb41223f26193c89396684af43a25

    • SHA1

      7a85c7825db906e71b95e711a6502b186d8bc4b1

    • SHA256

      02cfcdc462714b186e05ae43f430a9adbac37273445ee2c561a04c0e3bed7761

    • SHA512

      e65d6e31407b70bde61cf96aa0e6c11a4c49937bcb3c7517742fac5509a92ba4c4104280c9fdbc925d52df765348f90a05b0c9df6d4ae7e3b9a49fd1195712b6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks