Overview

overview

10

Static

static

152e1f2121...88.exe

windows7_x64

10

152e1f2121...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    152e1f21214581c28ee93702f644bd7254dcf7b5d933592a720d07654e010e88

  • Size

    58KB

  • Sample

    220212-e6zx2ahegl

  • MD5

    3ce68914da6db98a48c5dc00ed009a73

  • SHA1

    e49b395175cf4b26b29e187a2e85009c4836d690

  • SHA256

    152e1f21214581c28ee93702f644bd7254dcf7b5d933592a720d07654e010e88

  • SHA512

    a16c8c4b8a2573b14c6f4093928d4054bc884b75c0e3d3d3c5256bcf756dfe042a349d6cf548d6bd69fb56bd12ab891cd6500f0d6c32d393e03d06140abd96fb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      152e1f21214581c28ee93702f644bd7254dcf7b5d933592a720d07654e010e88

    • Size

      58KB

    • MD5

      3ce68914da6db98a48c5dc00ed009a73

    • SHA1

      e49b395175cf4b26b29e187a2e85009c4836d690

    • SHA256

      152e1f21214581c28ee93702f644bd7254dcf7b5d933592a720d07654e010e88

    • SHA512

      a16c8c4b8a2573b14c6f4093928d4054bc884b75c0e3d3d3c5256bcf756dfe042a349d6cf548d6bd69fb56bd12ab891cd6500f0d6c32d393e03d06140abd96fb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks