Overview

overview

10

Static

static

02283f70c2...28.exe

windows7_x64

10

02283f70c2...28.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02283f70c2a9b31e19e917dd22281cd9c59730f124ca37969854ec95148fc628

  • Size

    36KB

  • Sample

    220212-pellfacbd5

  • MD5

    aebf2b208739999b124202015948f457

  • SHA1

    b0bd675389873f79b1290f526e36d74d4c928378

  • SHA256

    02283f70c2a9b31e19e917dd22281cd9c59730f124ca37969854ec95148fc628

  • SHA512

    90fd4627e5666857ed2a24490c73612b32bdc456c7e5ba3145d6fa9854c1c83cd91b18bb33c7dad16609c2d4ed6a3a2b114cff18f836e27280579bf058454476

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      02283f70c2a9b31e19e917dd22281cd9c59730f124ca37969854ec95148fc628

    • Size

      36KB

    • MD5

      aebf2b208739999b124202015948f457

    • SHA1

      b0bd675389873f79b1290f526e36d74d4c928378

    • SHA256

      02283f70c2a9b31e19e917dd22281cd9c59730f124ca37969854ec95148fc628

    • SHA512

      90fd4627e5666857ed2a24490c73612b32bdc456c7e5ba3145d6fa9854c1c83cd91b18bb33c7dad16609c2d4ed6a3a2b114cff18f836e27280579bf058454476

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks