Overview

overview

10

Static

static

03d345aec5...ec.exe

windows7_x64

10

03d345aec5...ec.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03d345aec5d62857c493005db9944c740187c8b2fea23246ec9a29a26a1c37ec

  • Size

    60KB

  • Sample

    220212-nsc1sabgh6

  • MD5

    13901b6ff6ff3a9727300cf8f071cd28

  • SHA1

    fc740c055b5dba6944cae9187a1ac4032357ab22

  • SHA256

    03d345aec5d62857c493005db9944c740187c8b2fea23246ec9a29a26a1c37ec

  • SHA512

    cc8472242f6f7d0ff3ff045027dcbd40f9045d9e9207e46fc606e14b8520204d1b1853db053174a06f7712b030d02be405714959e2ca0d8395a10b199c7f6caa

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      03d345aec5d62857c493005db9944c740187c8b2fea23246ec9a29a26a1c37ec

    • Size

      60KB

    • MD5

      13901b6ff6ff3a9727300cf8f071cd28

    • SHA1

      fc740c055b5dba6944cae9187a1ac4032357ab22

    • SHA256

      03d345aec5d62857c493005db9944c740187c8b2fea23246ec9a29a26a1c37ec

    • SHA512

      cc8472242f6f7d0ff3ff045027dcbd40f9045d9e9207e46fc606e14b8520204d1b1853db053174a06f7712b030d02be405714959e2ca0d8395a10b199c7f6caa

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks