Overview

overview

10

Static

static

03e0d5c67d...c7.exe

windows7_x64

10

03e0d5c67d...c7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03e0d5c67d14312fe925782b48e0f387d80e0bf8a389c6516307de0ba923dfc7

  • Size

    35KB

  • Sample

    220212-nrvjfadedr

  • MD5

    f115551bdc1aba4a853f7d5670984b80

  • SHA1

    cfac089e1122ca7d929393c55d8c75f0839d26ea

  • SHA256

    03e0d5c67d14312fe925782b48e0f387d80e0bf8a389c6516307de0ba923dfc7

  • SHA512

    5ec930ac8320a152dd9b5d558341ae5abb527c1b999856402e033a358dc190c07f7a610028301a21c0aef15122f2e5a88b59936611d148a613b19807b087fbd5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03e0d5c67d14312fe925782b48e0f387d80e0bf8a389c6516307de0ba923dfc7

    • Size

      35KB

    • MD5

      f115551bdc1aba4a853f7d5670984b80

    • SHA1

      cfac089e1122ca7d929393c55d8c75f0839d26ea

    • SHA256

      03e0d5c67d14312fe925782b48e0f387d80e0bf8a389c6516307de0ba923dfc7

    • SHA512

      5ec930ac8320a152dd9b5d558341ae5abb527c1b999856402e033a358dc190c07f7a610028301a21c0aef15122f2e5a88b59936611d148a613b19807b087fbd5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks