Overview

overview

10

Static

static

03f287ce24...70.exe

windows7_x64

10

03f287ce24...70.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03f287ce2423b64e3dacec992951506f7e295b4d43e2e9a5a3f45a2bbe792e70

  • Size

    58KB

  • Sample

    220212-nqy58sbgg2

  • MD5

    6626bcb31660aaf9020d9916ee49fca9

  • SHA1

    3d641caed4c8704d7ee3152265c6cf0aaa8f9733

  • SHA256

    03f287ce2423b64e3dacec992951506f7e295b4d43e2e9a5a3f45a2bbe792e70

  • SHA512

    2976508eb6aec1e49dff19c59618b5bd6a363377ffe91e91f91c5193e283649935650b21e8d126659559a7bd4963f5ff0262a23d400d6b1c7b7a933160189a31

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03f287ce2423b64e3dacec992951506f7e295b4d43e2e9a5a3f45a2bbe792e70

    • Size

      58KB

    • MD5

      6626bcb31660aaf9020d9916ee49fca9

    • SHA1

      3d641caed4c8704d7ee3152265c6cf0aaa8f9733

    • SHA256

      03f287ce2423b64e3dacec992951506f7e295b4d43e2e9a5a3f45a2bbe792e70

    • SHA512

      2976508eb6aec1e49dff19c59618b5bd6a363377ffe91e91f91c5193e283649935650b21e8d126659559a7bd4963f5ff0262a23d400d6b1c7b7a933160189a31

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks