Overview

overview

10

Static

static

03ec08129e...05.exe

windows7_x64

10

03ec08129e...05.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03ec08129eae64b0bfe97e932885e677a78ec9ead7359624c184310adca91d05

  • Size

    58KB

  • Sample

    220212-nq9xqsbgg6

  • MD5

    cc4e6e83790abdaf8d27d0bb5c1720cc

  • SHA1

    2caf5ed6f820e10e6b8e87d2cadea1aef80df5ce

  • SHA256

    03ec08129eae64b0bfe97e932885e677a78ec9ead7359624c184310adca91d05

  • SHA512

    422137660d4a1dede3bdb0ed9c3047fe0ec471cfd7ca3ba1871d25573bfb84c948a373a019af463024c8983c9131291f4d62de64b291d9f7d7b026e06166dc63

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03ec08129eae64b0bfe97e932885e677a78ec9ead7359624c184310adca91d05

    • Size

      58KB

    • MD5

      cc4e6e83790abdaf8d27d0bb5c1720cc

    • SHA1

      2caf5ed6f820e10e6b8e87d2cadea1aef80df5ce

    • SHA256

      03ec08129eae64b0bfe97e932885e677a78ec9ead7359624c184310adca91d05

    • SHA512

      422137660d4a1dede3bdb0ed9c3047fe0ec471cfd7ca3ba1871d25573bfb84c948a373a019af463024c8983c9131291f4d62de64b291d9f7d7b026e06166dc63

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks