Overview

overview

10

Static

static

02bf51dbc2...a9.exe

windows7_x64

10

02bf51dbc2...a9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02bf51dbc2dc04392cda77e869f6a155b3648047c232d6660d9de4339e6c35a9

  • Size

    58KB

  • Sample

    220212-n6q5kadgbl

  • MD5

    8394a3790b749ab6b2a4e4490e08099d

  • SHA1

    0348178d46bae1717fae050f4c6ca006a955be67

  • SHA256

    02bf51dbc2dc04392cda77e869f6a155b3648047c232d6660d9de4339e6c35a9

  • SHA512

    708b57534333137c348648e8742884f1e2191ea5b1f70278e88bdaf738d2df42ac796038f78bc863d29b6a0794c02f6a5cfe0c4a4eb4f99af4ae10bed74f4807

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02bf51dbc2dc04392cda77e869f6a155b3648047c232d6660d9de4339e6c35a9

    • Size

      58KB

    • MD5

      8394a3790b749ab6b2a4e4490e08099d

    • SHA1

      0348178d46bae1717fae050f4c6ca006a955be67

    • SHA256

      02bf51dbc2dc04392cda77e869f6a155b3648047c232d6660d9de4339e6c35a9

    • SHA512

      708b57534333137c348648e8742884f1e2191ea5b1f70278e88bdaf738d2df42ac796038f78bc863d29b6a0794c02f6a5cfe0c4a4eb4f99af4ae10bed74f4807

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks