Overview

overview

10

Static

static

15f259b8d2...c7.exe

windows7_x64

10

15f259b8d2...c7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15f259b8d2b170ff6e8e0a4d659e12ba23159577bef6683672c47f06cafb69c7

  • Size

    58KB

  • Sample

    220212-eqa9qsfgh2

  • MD5

    9e7d727460945722d055d94f7a426abf

  • SHA1

    f44ca5dac56342f79bb9e0e1e35c3b6fd2862ed4

  • SHA256

    15f259b8d2b170ff6e8e0a4d659e12ba23159577bef6683672c47f06cafb69c7

  • SHA512

    cfe0ffe0c0950c3141c624a5a27a087caa1777b592bcd4561407536007217060288013d6d3038003d70e49931a065ba3f7fc63574513c80455adcaf4127555c7

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15f259b8d2b170ff6e8e0a4d659e12ba23159577bef6683672c47f06cafb69c7

    • Size

      58KB

    • MD5

      9e7d727460945722d055d94f7a426abf

    • SHA1

      f44ca5dac56342f79bb9e0e1e35c3b6fd2862ed4

    • SHA256

      15f259b8d2b170ff6e8e0a4d659e12ba23159577bef6683672c47f06cafb69c7

    • SHA512

      cfe0ffe0c0950c3141c624a5a27a087caa1777b592bcd4561407536007217060288013d6d3038003d70e49931a065ba3f7fc63574513c80455adcaf4127555c7

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks