Overview

overview

10

Static

static

1527964a39...2c.exe

windows7_x64

10

1527964a39...2c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1527964a39cd45c4c78f60a83bb015c7d0e9484518731b53a03fbd18ea94102c

  • Size

    58KB

  • Sample

    220212-e7fksahehj

  • MD5

    20acd6673e8e4d933ba8d1718b9c28a8

  • SHA1

    d8b031c11ffc858e801f03d52aad7c7808f2b653

  • SHA256

    1527964a39cd45c4c78f60a83bb015c7d0e9484518731b53a03fbd18ea94102c

  • SHA512

    7f473a6923fc1ec48f216a3236d169b62f9c147c352bacbe712b78040edfb71bfebd1be3c26d5889a53a5a2d010fe85c8a5d623b30e2f74ffb91f2904934546e

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      1527964a39cd45c4c78f60a83bb015c7d0e9484518731b53a03fbd18ea94102c

    • Size

      58KB

    • MD5

      20acd6673e8e4d933ba8d1718b9c28a8

    • SHA1

      d8b031c11ffc858e801f03d52aad7c7808f2b653

    • SHA256

      1527964a39cd45c4c78f60a83bb015c7d0e9484518731b53a03fbd18ea94102c

    • SHA512

      7f473a6923fc1ec48f216a3236d169b62f9c147c352bacbe712b78040edfb71bfebd1be3c26d5889a53a5a2d010fe85c8a5d623b30e2f74ffb91f2904934546e

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks