Overview

overview

10

Static

static

10

037474def3...69.exe

windows7_x64

10

037474def3...69.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    037474def3e69db91963227705e5adfb1ae1a15883da07dff15fd887fb5e2369

  • Size

    101KB

  • Sample

    220212-nxdswadfbm

  • MD5

    a7979d72ba272ef3540a1dd26e290595

  • SHA1

    922cbca9b2778fadf59ca27c16072e0098281e78

  • SHA256

    037474def3e69db91963227705e5adfb1ae1a15883da07dff15fd887fb5e2369

  • SHA512

    fc4316846e6f2b6260d7ef49d78e827de838c03a84ebd08f2069a1cc3bb4bc45bbb7c4aae842eb85b4d17e821cc0bcefc1f7ec50ff56d2d15836537dda3b1842

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      037474def3e69db91963227705e5adfb1ae1a15883da07dff15fd887fb5e2369

    • Size

      101KB

    • MD5

      a7979d72ba272ef3540a1dd26e290595

    • SHA1

      922cbca9b2778fadf59ca27c16072e0098281e78

    • SHA256

      037474def3e69db91963227705e5adfb1ae1a15883da07dff15fd887fb5e2369

    • SHA512

      fc4316846e6f2b6260d7ef49d78e827de838c03a84ebd08f2069a1cc3bb4bc45bbb7c4aae842eb85b4d17e821cc0bcefc1f7ec50ff56d2d15836537dda3b1842

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks