Overview

overview

10

Static

static

10

154da4ea16...4e.exe

windows7_x64

10

154da4ea16...4e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    154da4ea1651f37763371e91f879844420ed1c252d6a561f9e3244056ae4df4e

  • Size

    92KB

  • Sample

    220212-e2nzzagab8

  • MD5

    87c2658bb8060bcc08f026bc42a3e534

  • SHA1

    d07cc63b2ef637071d3270a0bd75fce14479a3c6

  • SHA256

    154da4ea1651f37763371e91f879844420ed1c252d6a561f9e3244056ae4df4e

  • SHA512

    7a0283aa9ac20f893cbd3d09244aac0e180b9345b15b36887f7abe30c8facf8c7335461ee9306d7d79f08e4583a9b45453eb5e1733cc26eefa15632685986d69

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      154da4ea1651f37763371e91f879844420ed1c252d6a561f9e3244056ae4df4e

    • Size

      92KB

    • MD5

      87c2658bb8060bcc08f026bc42a3e534

    • SHA1

      d07cc63b2ef637071d3270a0bd75fce14479a3c6

    • SHA256

      154da4ea1651f37763371e91f879844420ed1c252d6a561f9e3244056ae4df4e

    • SHA512

      7a0283aa9ac20f893cbd3d09244aac0e180b9345b15b36887f7abe30c8facf8c7335461ee9306d7d79f08e4583a9b45453eb5e1733cc26eefa15632685986d69

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks