Overview

overview

10

Static

static

10

03e2a71a25...07.exe

windows7_x64

10

03e2a71a25...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03e2a71a25874a6435cdaacac4ef8e71f382ed8cb2f713418d71498a3b255107

  • Size

    150KB

  • Sample

    220212-nrspvabgh3

  • MD5

    0def14a5e149b007cbb9f961bf5d92c9

  • SHA1

    cbea4079ab680ac36d01f8b4050dd983fb2627f5

  • SHA256

    03e2a71a25874a6435cdaacac4ef8e71f382ed8cb2f713418d71498a3b255107

  • SHA512

    f1b0c94c4c19318ca851a892316b2119f741f63d4417909c4c9799deb33c06177502fde27f483323a05bfd8fa04e35b3825022f0ae5a6a9d46155337bfb3dab6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03e2a71a25874a6435cdaacac4ef8e71f382ed8cb2f713418d71498a3b255107

    • Size

      150KB

    • MD5

      0def14a5e149b007cbb9f961bf5d92c9

    • SHA1

      cbea4079ab680ac36d01f8b4050dd983fb2627f5

    • SHA256

      03e2a71a25874a6435cdaacac4ef8e71f382ed8cb2f713418d71498a3b255107

    • SHA512

      f1b0c94c4c19318ca851a892316b2119f741f63d4417909c4c9799deb33c06177502fde27f483323a05bfd8fa04e35b3825022f0ae5a6a9d46155337bfb3dab6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks