Overview

overview

10

Static

static

150e54b3e9...9a.exe

windows7_x64

10

150e54b3e9...9a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    150e54b3e9f7589df60689a67620577b16e8c7532ac02c7912bfb1e3aefa0a9a

  • Size

    36KB

  • Sample

    220212-e8aqxsgae9

  • MD5

    b9365e30d47a5b2a378298d4a7e3aac6

  • SHA1

    47a0e814c10d305e0c31cb22baab65ab4f507957

  • SHA256

    150e54b3e9f7589df60689a67620577b16e8c7532ac02c7912bfb1e3aefa0a9a

  • SHA512

    afdabcad6addd982f976a43e99802835f906a097b7d54f6e87cea182958ff9abc5b7df4cd5490a5c73880aa13285df3eeb8fe1e7b97478d006249e3f73fcac96

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      150e54b3e9f7589df60689a67620577b16e8c7532ac02c7912bfb1e3aefa0a9a

    • Size

      36KB

    • MD5

      b9365e30d47a5b2a378298d4a7e3aac6

    • SHA1

      47a0e814c10d305e0c31cb22baab65ab4f507957

    • SHA256

      150e54b3e9f7589df60689a67620577b16e8c7532ac02c7912bfb1e3aefa0a9a

    • SHA512

      afdabcad6addd982f976a43e99802835f906a097b7d54f6e87cea182958ff9abc5b7df4cd5490a5c73880aa13285df3eeb8fe1e7b97478d006249e3f73fcac96

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks