Overview

overview

10

Static

static

04f97471bd...25.exe

windows7_x64

10

04f97471bd...25.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04f97471bdb347bf70329dd3f508dbbf917398c56dc1b3c1127087ee3fd4a825

  • Size

    36KB

  • Sample

    220212-nbr4dadcdp

  • MD5

    e3ada4312a329d9366a48ea160d2123d

  • SHA1

    3b7e7b821a29639b1c59677c2e7d38ef46dab43d

  • SHA256

    04f97471bdb347bf70329dd3f508dbbf917398c56dc1b3c1127087ee3fd4a825

  • SHA512

    66d71b38504f60faf04e93c7e3a12967b19d5e29630c50c560bd2848624d2ce6002f869c18bc792a12e2343d28a9213ba3bf61d638b3056b3ff893c322564135

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      04f97471bdb347bf70329dd3f508dbbf917398c56dc1b3c1127087ee3fd4a825

    • Size

      36KB

    • MD5

      e3ada4312a329d9366a48ea160d2123d

    • SHA1

      3b7e7b821a29639b1c59677c2e7d38ef46dab43d

    • SHA256

      04f97471bdb347bf70329dd3f508dbbf917398c56dc1b3c1127087ee3fd4a825

    • SHA512

      66d71b38504f60faf04e93c7e3a12967b19d5e29630c50c560bd2848624d2ce6002f869c18bc792a12e2343d28a9213ba3bf61d638b3056b3ff893c322564135

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks