Overview

overview

10

Static

static

02912a4aea...9e.exe

windows7_x64

10

02912a4aea...9e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02912a4aeab37ccc548ac14db07c7066b5774f36175dfeea4d2096861dc6f49e

  • Size

    35KB

  • Sample

    220212-n8a65adgdl

  • MD5

    69f7329b745d5f42484fc66bd44f8733

  • SHA1

    f2fa2f89a85ce15af9e7d124a0202b8a241cf367

  • SHA256

    02912a4aeab37ccc548ac14db07c7066b5774f36175dfeea4d2096861dc6f49e

  • SHA512

    947642382d215db9064c18fa9f563d8843753f8c71dca048c6d472c215912947b86b3fa6d380fd08de1c0fd7cde7826907985152d62a1b73c4f113a2b541ed74

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02912a4aeab37ccc548ac14db07c7066b5774f36175dfeea4d2096861dc6f49e

    • Size

      35KB

    • MD5

      69f7329b745d5f42484fc66bd44f8733

    • SHA1

      f2fa2f89a85ce15af9e7d124a0202b8a241cf367

    • SHA256

      02912a4aeab37ccc548ac14db07c7066b5774f36175dfeea4d2096861dc6f49e

    • SHA512

      947642382d215db9064c18fa9f563d8843753f8c71dca048c6d472c215912947b86b3fa6d380fd08de1c0fd7cde7826907985152d62a1b73c4f113a2b541ed74

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks