Overview

overview

10

Static

static

10

15040b1183...23.exe

windows7_x64

10

15040b1183...23.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15040b11831f3b4ef1c050244748427332e367aae6235e7fdba6dcafa14cf423

  • Size

    80KB

  • Sample

    220212-e833gahfbj

  • MD5

    c79ba484b17434aa8c80672c09272a08

  • SHA1

    8fd799a4da99c4b016df98661043a0a556cf259f

  • SHA256

    15040b11831f3b4ef1c050244748427332e367aae6235e7fdba6dcafa14cf423

  • SHA512

    411ced3cee118badd8d91faa0cae523a373879ddb6b5c8c69dcca8a69727c40b3063396c7348af12d330f78b4eb1bd3bbcc3bc0cfc94f147acc1a6ff7d256e51

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15040b11831f3b4ef1c050244748427332e367aae6235e7fdba6dcafa14cf423

    • Size

      80KB

    • MD5

      c79ba484b17434aa8c80672c09272a08

    • SHA1

      8fd799a4da99c4b016df98661043a0a556cf259f

    • SHA256

      15040b11831f3b4ef1c050244748427332e367aae6235e7fdba6dcafa14cf423

    • SHA512

      411ced3cee118badd8d91faa0cae523a373879ddb6b5c8c69dcca8a69727c40b3063396c7348af12d330f78b4eb1bd3bbcc3bc0cfc94f147acc1a6ff7d256e51

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks