Overview

overview

10

Static

static

03f47021ac...54.exe

windows7_x64

10

03f47021ac...54.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03f47021ac144e161a3e776b659b257f5f9d57beab9fc5497e1bb81ec4cadf54

  • Size

    35KB

  • Sample

    220212-nqrq6abgf8

  • MD5

    57bab160f2dca8eb1854d5570719c203

  • SHA1

    90006cbc16b5a4594e087ebafb22ba4a06c7b4cd

  • SHA256

    03f47021ac144e161a3e776b659b257f5f9d57beab9fc5497e1bb81ec4cadf54

  • SHA512

    4df980304acec35849e0d477c51cc518d0fd28f2594de04852520cd78c52c13f29784dd59b1ef9cf5304a5a1889b6a88d63df45bffc3b3be725cc7a4ecac2004

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03f47021ac144e161a3e776b659b257f5f9d57beab9fc5497e1bb81ec4cadf54

    • Size

      35KB

    • MD5

      57bab160f2dca8eb1854d5570719c203

    • SHA1

      90006cbc16b5a4594e087ebafb22ba4a06c7b4cd

    • SHA256

      03f47021ac144e161a3e776b659b257f5f9d57beab9fc5497e1bb81ec4cadf54

    • SHA512

      4df980304acec35849e0d477c51cc518d0fd28f2594de04852520cd78c52c13f29784dd59b1ef9cf5304a5a1889b6a88d63df45bffc3b3be725cc7a4ecac2004

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks