Overview

overview

10

Static

static

10

153f7d6fae...04.exe

windows7_x64

10

153f7d6fae...04.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    153f7d6faeb3e9b2e13e84a4cfe12f84405bcdf81b98e047b20cfb68e50e4a04

  • Size

    176KB

  • Sample

    220212-e3gmaagac7

  • MD5

    aed74dd725e4881caaef645a084da004

  • SHA1

    6297f56b4ecca15c5533a97b2c0f539274e56032

  • SHA256

    153f7d6faeb3e9b2e13e84a4cfe12f84405bcdf81b98e047b20cfb68e50e4a04

  • SHA512

    0f35da1a82e3ca945b6e400d3adfaf711a480f813f088da663248bdc17aae352e0f9583a91685e1c571f372840ed345f3783244a9954dcaa5f4362c7101d8789

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      153f7d6faeb3e9b2e13e84a4cfe12f84405bcdf81b98e047b20cfb68e50e4a04

    • Size

      176KB

    • MD5

      aed74dd725e4881caaef645a084da004

    • SHA1

      6297f56b4ecca15c5533a97b2c0f539274e56032

    • SHA256

      153f7d6faeb3e9b2e13e84a4cfe12f84405bcdf81b98e047b20cfb68e50e4a04

    • SHA512

      0f35da1a82e3ca945b6e400d3adfaf711a480f813f088da663248bdc17aae352e0f9583a91685e1c571f372840ed345f3783244a9954dcaa5f4362c7101d8789

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks