Overview

overview

10

Static

static

10

02b4f6afa1...97.exe

windows7_x64

10

02b4f6afa1...97.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02b4f6afa145a6f1b65e2d35db1b0ed674cbcb15900a58f7eeffbbb48e98e097

  • Size

    99KB

  • Sample

    220212-n65myscae7

  • MD5

    9cbac2fec1ad1dcb349734acf6debb29

  • SHA1

    a5a17a6155f836a177bad5ae216e01bccb561f9b

  • SHA256

    02b4f6afa145a6f1b65e2d35db1b0ed674cbcb15900a58f7eeffbbb48e98e097

  • SHA512

    fedef63c447dfd0b97e240de124116dfd0b376033824a20dd97959dfcc13c1772128afe215bfab8c8f259b674ba12ba781c71f4e1d662edf1bb06234269a38dd

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02b4f6afa145a6f1b65e2d35db1b0ed674cbcb15900a58f7eeffbbb48e98e097

    • Size

      99KB

    • MD5

      9cbac2fec1ad1dcb349734acf6debb29

    • SHA1

      a5a17a6155f836a177bad5ae216e01bccb561f9b

    • SHA256

      02b4f6afa145a6f1b65e2d35db1b0ed674cbcb15900a58f7eeffbbb48e98e097

    • SHA512

      fedef63c447dfd0b97e240de124116dfd0b376033824a20dd97959dfcc13c1772128afe215bfab8c8f259b674ba12ba781c71f4e1d662edf1bb06234269a38dd

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks