Overview

overview

10

Static

static

10

15fa0c7871...63.exe

windows7_x64

10

15fa0c7871...63.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663

  • Size

    99KB

  • Sample

    220212-ep5f7afgg8

  • MD5

    e3f86fac24507d5749aa688fe0410fa6

  • SHA1

    58529e7c828cc78cea4be5428e426bb87990c3af

  • SHA256

    15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663

  • SHA512

    3f1cd778b0dcaddba0eb035f7f25bca296c83f585aefbec28874937ed352d3583fc2d6ce3238640ee36b33c1343e11f6043c25a4d69a1fab642a4d7d68cdd162

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663

    • Size

      99KB

    • MD5

      e3f86fac24507d5749aa688fe0410fa6

    • SHA1

      58529e7c828cc78cea4be5428e426bb87990c3af

    • SHA256

      15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663

    • SHA512

      3f1cd778b0dcaddba0eb035f7f25bca296c83f585aefbec28874937ed352d3583fc2d6ce3238640ee36b33c1343e11f6043c25a4d69a1fab642a4d7d68cdd162

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks